@dreamguyxeon/libsignal-node@1.0.1

Analysis

Trojanized clone of the legitimate libsignal-node package, published under the @dreamguyxeon scope. The package ships real Signal protocol source code as cover, but index.js loads install.js which patches the @whiskeysockets/baileys WhatsApp library at runtime. The patch replaces the newsletter.js module to fetch a list of channel IDs from raw[.]githubusercontent[.]com/DGXeon13/strings/refs/heads/main/strings.json and automatically follow those WhatsApp newsletter channels. The package also depends on the npm placeholder packages 'crypto', 'fs', and 'path' (dependency confusion), which are not Node.js built-in modules but separate npm packages that could be hijacked.