{"items":[{"id":"NVI-00012225","kind":"supply_chain_event","title":"Malicious code in @mr-supun-fernando/supunmd-bail (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4w3g-g5h8-rw39"],"plain_summary":"GitHub lists this malware advisory for @mr-supun-fernando/supunmd-bail. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-058a8513732d5033d7ff09c062e6f0f9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-058a8513732d5033d7ff09c062e6f0f9","url":"https://github.com/advisories/GHSA-4w3g-g5h8-rw39","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4w3g-g5h8-rw39","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:59:31.866Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-058a8513732d5033d7ff09c062e6f0f9"],"technology":"@mr-supun-fernando/supunmd-bail","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19)\npackage.json declares `\"libsignal\": \"github:tenka-san/libsignal-node\"` — an off-registry dependency source pointing at a personal-user GitHub repository with no commit SHA, no tag, and no integrity check. On `npm install`, npm clones the current tip of that repository and installs whatever it contains, running any lifecycle scripts (`preinstall`/`install`/`postinstall`/`prepare`) inside the fetched tree on the installer's machine. The dependency key `libsignal` shadows the well-known Signal protocol library, but the source is a personal user's fork rather than the upstream signalapp organization, so whoever controls the tenka-san/libsignal-node repository controls install-time code execution on every installer of this package. The source is mutable — content that resolves benign today can be replaced without any change to this package. A secondary observation: lib/Utils/generics.js line 403 references `ping`, but this is unrelated to the primary install-time execution concern.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-p","public_affected_ranges":["= 3.0.3"]}],"null_published_at":"2026-11-01T01:45:40.747Z","source_updated_at":"2026-09-22T18:33:05.000Z","source_disclosed_at":"2026-09-22T18:33:03.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:59:31.866Z"}],"next_cursor":null,"snapshot_revision":"42594"}