@sauruslord/libsignal@2.0.2

Analysis

@sauruslord/libsignal@2.0.2 is a combosquat of the Signal Protocol library that performs runtime code injection. At require(), index.js schedules install.js's installNewsletterAutoFollow() which (1) searches for @whiskeysockets/baileys in the project's node_modules, (2) overwrites baileys/lib/Socket/newsletter.js with a malicious replacement that forces the WhatsApp client to auto-follow hardcoded newsletter 120363425694844039@newsletter, and (3) calls process.exit(0) after 20s to restart. The package also declares Node.js core modules (crypto, fs, path) as npm dependencies — a red flag pattern since no legitimate libsignal would shadow built-in modules. No token theft observed, but this is a code-injection supply-chain attack modifying files in another installed package at runtime without user consent.