anya-bail@1.1.5

Analysis

anya-bail@1.1.5 is a combosquat of the Baileys WhatsApp Web library that hijacks the 'libsignal' dependency. The package pins libsignal to a tarball URL under the @queenanya npm scope instead of the real libsignal package. When the package imports libsignal for Signal Protocol crypto operations, the attacker-controlled code from @queenanya/libsignal is loaded instead, enabling arbitrary code execution in the cryptographic layer. The package has no repository and the publisher email is a throwaway address.