Loading npm security reports…

@astralcore/aura-wb@1.0.10: Malicious npm security report (Block) | LPM Firewall

registry / @astralcore/aura-wb / 1.0.10

@astralcore/aura-wb@1.0.10

AURA — WhatsApp bot (npm/yarn package build)

AI Security Review

scanned 7d ago · by lpm-firewall-ai

At runtime, the bot persists WhatsApp authentication credentials and Signal keys to a package-author-controlled shared MongoDB service. It also has a Telegram notification path that forwards message previews to a fixed chat.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the bot and pairs a WhatsApp account.

Impact

The package operator or anyone controlling the shared database can access persisted WhatsApp session material; message previews can reach a fixed external Telegram recipient.

Mechanism

remote storage of WhatsApp auth material and message-preview forwarding

Attack narrative

Running the bot connects to the hardcoded shared MongoDB service. Baileys credentials and Signal keys are serialized into its AuthState collection on credential updates, enabling external retention of the paired WhatsApp session. A separate runtime handler can send a reacting user's identifier and prior message preview to a fixed Telegram chat when its token is configured.

Rationale

The shared hardcoded database is not needed for local bot operation yet receives WhatsApp authentication material. This is concrete credential exfiltration/persistence, not merely a noisy scanner primitive.

Evidence

package.jsonstart.jsconfig/index.jssrc/commands/index.jsscripts/ensure-termux-deps.js

Network endpoints2

unity-free.pc6vkvw.mongodb.net

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/commands/tools.jsView file

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

High Secret

Package contains a high-severity secret pattern.

src/commands/tools.jsView on unpkg · L509

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.8 matchedPath = src/commands/tools.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/tools.jsView on unpkg

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/tools.js

src/commands/tools.jsView on unpkg · L509

start.jsView file

1'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

start.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

start.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

src/media/startup_voice.oggView file

•path = src/media/startup_voice.ogg kind = high_entropy_blob sizeBytes = 1398105 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/media/startup_voice.oggView on unpkg

src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.8 matchedPath = src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/extra_media.jsView on unpkg

33patternName = google_api_key severity = high line = 33 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/extra_media.js

src/commands/extra_media.jsView on unpkg · L33

src/commands/myfunc2.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.8 matchedPath = src/commands/myfunc2.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/myfunc2.jsView on unpkg

src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.8 matchedPath = src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/sticker.jsView on unpkg

src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.8 matchedPath = src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/unity_dl.jsView on unpkg