MAL-2026-16473

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2aaf4b5ddb859270a86aa6d21df680ed66fb0622434317747a6f7275ad9a3d60) sea-baileys is a fork of the Baileys WhatsApp Web library. Its package.json remaps the `libsignal` import specifier to `npm:@otaxayun/libsignal-node@latest` — an unrelated maintainer's package pinned to the mutable `latest` dist-tag rather than a fixed version or integrity hash. lib/Signal/libsignal.js routes the installer's Signal Protocol identity private key, signed pre-key private key, session records and sender keys through this dependency, so whatever code `@otaxayun/libsignal-node` resolves to at install time handles the consumer's WhatsApp cryptographic identity and message stream. Because the tag is mutable and owned by a third party outside the sea-baileys publisher, a single publish under that name replaces the crypto implementation on every subsequent `npm install`. Separately, lib/Utils/messages-media.js's prepareWAMessageMedia unconditionally attaches a hardcoded `annotations` block referencing the newsletter JID `120363409928671192@newsletter` ("HOSHINO AI INFORMATION") to every outgoing media message when the caller does not supply annotations, silently modifying consumer-generated WhatsApp payloads to advertise the fork author's channel.