Loading npm security reports…

@astralcore/aura-wb: Malicious npm security report (Block) | LPM Firewall

registry / @astralcore/aura-wb / 1.0.39

@astralcore/aura-wb@1.0.39

AURA — WhatsApp bot (npm/yarn package build)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing on Termux automatically invokes its system package manager. During bot operation, reactions can transmit the sender number, reaction, and up to 80 characters of message content to a fixed Telegram chat.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation on Termux; then receiving a WhatsApp reaction while the bot has a Telegram token configured.

Impact

Unconsented system mutation at install time and disclosure of WhatsApp metadata and message excerpts to an operator-controlled chat.

Mechanism

Automatic system-package installation and Telegram forwarding of WhatsApp data.

Attack narrative

The package has a preinstall lifecycle hook that conditionally installs Termux system packages without a user command. Its bot runtime also sends reaction-associated WhatsApp data, including a phone number and optional message excerpt, to a hard-coded Telegram chat whenever the supplied Telegram bot token is available. These behaviors create concrete install-time mutation and data-exfiltration paths.

AI rationale

Source inspection confirms automatic install-time system mutation and runtime forwarding of private WhatsApp data to a fixed external recipient. The token gate does not provide consent from the WhatsApp participants whose data is sent.

Evidence

package.jsondist/scripts/ensure-termux-deps.jsdist/start.js

Network endpoints1

api.telegram.org

Decision evidence

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.preinstall = node dist/scripts/ensure-termux-deps.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node dist/scripts/ensure-termux-deps.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/commands/tools.jsView file

1patternName = google_api_key severity = high line = 1

High

High Secret

Package contains a high-severity secret pattern.

dist/src/commands/tools.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/tools.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/tools.jsView on unpkg

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/src/commands/tools.js

dist/src/commands/tools.jsView on unpkg · L1

dist/start.jsView file

1"use strict";require("dotenv").config({path:require("path").join(__dirname,"config.env")});const _origConsoleLog=console.log.bind(console),_NOISY_PATTERNS=[/^Closing session:/,/^Re...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/start.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/start.js L1: "use strict";require("dotenv").config({path:require("path").join(__dirname,"config.env")});const _origConsoleLog=console.log.bind(console),_NOISY_PATTERNS=[/^Closing session:/,/^Re...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/start.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.main -> dist/start.js L1: "use strict";require("dotenv").config({path:require("path").join(__dirname,"config.env")});const _origConsoleLog=console.log.bind(console),_NOISY_PATTERNS=[/^Closing session:/,/^Re...

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/start.jsView on unpkg · L1

•

dist/src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/extra_media.jsView on unpkg

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/src/commands/extra_media.js

dist/src/commands/extra_media.jsView on unpkg · L1

dist/src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/sticker.jsView on unpkg

dist/src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/unity_dl.jsView on unpkg

dist/src/commands/unity_extra.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/unity_extra.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/unity_extra.jsView on unpkg

dist/src/commands/unity_img_extra.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/unity_img_extra.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/unity_img_extra.jsView on unpkg

dist/src/commands/media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/media.jsView on unpkg

dist/src/commands/myfunc2.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/myfunc2.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/myfunc2.jsView on unpkg

dist/src/commands/parser.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/parser.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/parser.jsView on unpkg

dist/src/sessionManager.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/sessionManager.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/sessionManager.jsView on unpkg

dist/scripts/ensure-termux-deps.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/scripts/ensure-termux-deps.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/ensure-termux-deps.jsView on unpkg