{"items":[{"id":"NVI-00011073","kind":"supply_chain_event","title":"Malicious code in focaleys (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jfhq-f5v2-pf3m"],"plain_summary":"GitHub lists this malware advisory for focaleys. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b4ce2679709b51d9f762f80b1f0e50f2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b4ce2679709b51d9f762f80b1f0e50f2","url":"https://github.com/advisories/GHSA-jfhq-f5v2-pf3m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jfhq-f5v2-pf3m","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:45.671Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b4ce2679709b51d9f762f80b1f0e50f2"],"technology":"focaleys","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (481093b5037c8aafc763d4543e5a6a39c2ebc7055673eb1d4f480f885593bcd2)\npackage.json declares the dependency 'libsignal' as 'github:rexxzyid/libsignal-node' with no tag, version, or commit SHA. On npm install, this resolves to whatever the default branch HEAD contains at that moment, with no integrity check, and any lifecycle scripts in the fetched repository execute on the installer's machine. Whoever controls the rexxzyid GitHub account controls code that runs at install time for every installer of focaleys, and the fetched code can change silently between installs without any change to focaleys itself.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 1.1.0"]}],"null_published_at":"2026-10-31T23:18:22.429Z","source_updated_at":"2026-09-30T12:35:32.000Z","source_disclosed_at":"2026-09-30T06:31:42.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:45.671Z"}],"next_cursor":null,"snapshot_revision":"42594"}