Malicious Code Vulnerability in noverojava: Potential Code Execution Risk
Summary
MAL-2026-16389: Malicious code in noverojava (npm). Affects noverojava versions 1.0.9 – 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The noverojava package is an npm library designed for interacting with WhatsApp through the Baileys protocol. It provides developers with tools to send messages, manage contacts, and perform other WhatsApp-related tasks. However, the package has been found to include a dependency that fetches code from an unverified GitHub repository, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the noverojava package declaring a runtime dependency on 'libsignal' from a GitHub repository instead of a stable version. This means that during installation, npm fetches the latest code from the repository's default branch, which could be malicious if the repository is compromised. The lack of a commit pin or integrity check allows an attacker to execute arbitrary code on the installer's machine, leading to potential data exfiltration or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall noverojavaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the noverojava package until a secure version is released. If you must use it, consider manually reviewing the dependency code fetched from GitHub to ensure it does not contain malicious scripts.
Conclusion
The noverojava package contains a serious vulnerability due to its reliance on an unverified GitHub dependency, which could lead to malicious code execution. It is crucial for developers using this package to update to a secure version and consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for noverojava →
FAQ
The noverojava package is an npm library used for interacting with WhatsApp through the Baileys protocol, allowing developers to send messages and manage contacts.
If your application uses the noverojava package, it may execute malicious code from an unverified GitHub repository, potentially compromising your system and data.
You should update to the latest patched version of noverojava immediately to mitigate the risk of executing malicious code.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the package-lock.json file, providing real-time alerts without requiring code access.
