MAL-2026-17329 Malicious code in focaleys (npm)
Malicious package
Published
MAL-2026-17329 is a malicious package: focaleys (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-17329/ (Markdown: https://insights.sbomify.com/MAL-2026-17329/index.md)
- Package
- focaleys
- Registry
- npm
What is MAL-2026-17329?
MAL-2026-17329 is a malicious package in focaleys, published on 30 Sep 2026.
Official description
package.json declares the dependency 'libsignal' as 'github:rexxzyid/libsignal-node' with no tag, version, or commit SHA. On npm install, this resolves to whatever the default branch HEAD contains at that moment, with no integrity check, and any lifecycle scripts in the fetched repository execute on the installer's machine. Whoever controls the rexxzyid GitHub account controls code that runs at install time for every installer of focaleys, and the fetched code can change silently between installs without any change to focaleys itself.
What should I do about MAL-2026-17329?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.