Loading npm security reports…

@astralcore/aura-wb@1.0.11: Malicious npm security report (Block) | LPM Firewall

registry / @astralcore/aura-wb / 1.0.11

@astralcore/aura-wb@1.0.11

AURA — WhatsApp bot (npm/yarn package build)

AI Security Review

scanned 7d ago · by lpm-firewall-ai

At runtime, the bot stores WhatsApp authentication credentials and signal keys in a hardcoded shared remote MongoDB by default. It also can send incoming-message previews to a fixed Telegram chat.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the package CLI and pairs a WhatsApp account.

Impact

The package author-controlled backend can receive account-authentication material; configured Telegram forwarding exposes message content.

Mechanism

remote persistence of WhatsApp credentials plus Telegram message-preview forwarding

Attack narrative

The normal CLI path sets a per-install session ID then starts start.js. That entrypoint connects using the package’s default shared MongoDB endpoint and saves Baileys credentials and signal keys there whenever credentials update. This exposes a paired user’s WhatsApp authentication state to the operator of that backend. Separately, reaction events can send sender numbers and message previews to a fixed Telegram recipient if a Telegram token is present.

Rationale

Runtime behavior establishes concrete credential exfiltration to a package-supplied remote datastore; it is not required for a local WhatsApp bot. The preinstall hook is unrelated and does not mitigate the runtime chain.

Evidence

package.jsonstart.jsconfig/index.jssrc/commands/index.jsbin/aura-wb.js

Network endpoints2

unity-free.pc6vkvw.mongodb.net

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/commands/tools.jsView file

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

High Secret

Package contains a high-severity secret pattern.

src/commands/tools.jsView on unpkg · L509

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.10 matchedPath = src/commands/tools.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/tools.jsView on unpkg

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/tools.js

src/commands/tools.jsView on unpkg · L509

start.jsView file

1'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

start.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

start.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

src/media/startup_voice.oggView file

•path = src/media/startup_voice.ogg kind = high_entropy_blob sizeBytes = 1398105 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/media/startup_voice.oggView on unpkg

src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.10 matchedPath = src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/extra_media.jsView on unpkg

33patternName = google_api_key severity = high line = 33 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/extra_media.js

src/commands/extra_media.jsView on unpkg · L33

src/commands/myfunc2.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.10 matchedPath = src/commands/myfunc2.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/myfunc2.jsView on unpkg

src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.10 matchedPath = src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/sticker.jsView on unpkg

src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.10 matchedPath = src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/unity_dl.jsView on unpkg