@astralcore/aura-wb@1.0.16: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@astralcore/aura-wb@1.0.16: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/commands/tools.jsView file

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

High Secret

Package contains a high-severity secret pattern.

src/commands/tools.jsView on unpkg · L509

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.15 matchedPath = src/commands/tools.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/tools.jsView on unpkg

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/tools.js

src/commands/tools.jsView on unpkg · L509

start.jsView file

1'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

start.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

start.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

src/media/startup_voice.oggView file

•path = src/media/startup_voice.ogg kind = high_entropy_blob sizeBytes = 782456 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/media/startup_voice.oggView on unpkg

src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.15 matchedPath = src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/extra_media.jsView on unpkg

33patternName = google_api_key severity = high line = 33 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/extra_media.js

src/commands/extra_media.jsView on unpkg · L33

src/commands/myfunc2.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.15 matchedPath = src/commands/myfunc2.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/myfunc2.jsView on unpkg

src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.15 matchedPath = src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/sticker.jsView on unpkg

src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.15 matchedPath = src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/unity_dl.jsView on unpkg