@astralcore/aura-wb@1.0.19: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@astralcore/aura-wb@1.0.19: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/commands/tools.jsView file

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

High Secret

Package contains a high-severity secret pattern.

src/commands/tools.jsView on unpkg · L509

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/tools.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/tools.jsView on unpkg

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/tools.js

src/commands/tools.jsView on unpkg · L509

start.jsView file

1'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

start.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

start.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

src/media/startup_voice.oggView file

•path = src/media/startup_voice.ogg kind = high_entropy_blob sizeBytes = 387966 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/media/startup_voice.oggView on unpkg

src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/extra_media.jsView on unpkg

33patternName = google_api_key severity = high line = 33 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/extra_media.js

src/commands/extra_media.jsView on unpkg · L33

src/commands/myfunc2.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/myfunc2.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/myfunc2.jsView on unpkg

src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/sticker.jsView on unpkg

src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/unity_dl.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "@astralcore/aura-wb",

3 "version": "1.0.19",

4 "description": "AURA — WhatsApp bot (npm/yarn package build)",

5 "main": "start.js",

6 "bin": {

7 "aura-wb": "bin/aura-wb.js"

8 },

9 "type": "commonjs",

10 "scripts": {

11 "preinstall": "node scripts/ensure-termux-deps.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "start": "node bin/aura-wb.js"

13 },

14 "engines": {

15 "node": ">=18.0.0"

16 },

17 "publishConfig": {

18 "access": "public"

19 },

20 "files": [

21 "bin",

22 "scripts",

23 "start.js",

24 "ecosystem.config.js",

25 "config",

26 "src",

27 "database",

28 "data",

29 "LICENSE"

30 ],

31 "dependencies": {

src/commands/tools.jsView file

Lines 489-529javascript

489 await sock.sendMessage(chat, { sticker: await img3.save(null) }, { quoted: msg });

490 await m.react('✅');

491 } catch (e) {

492 await m.

start.jsView file

Lines 1-21javascript

1'use strict';

2require('dotenv').config({ path: require('path').join(__dirname, 'config.env') });

3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

start.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/media/startup_voice.oggView file

•path = src/media/startup_voice.ogg kind = high_entropy_blob sizeBytes = 387966 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/media/startup_voice.oggView on unpkg

src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/extra_media.jsView on unpkg

33patternName = google_api_key severity = high line = 33 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/extra_media.js

src/commands/extra_media.jsView on unpkg · L33

src/commands/myfunc2.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/myfunc2.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/myfunc2.jsView on unpkg

src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/sticker.jsView on unpkg

src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.18 matchedPath = src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/unity_dl.jsView on unpkg