@astralcore/aura-wb@1.0.23: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@astralcore/aura-wb@1.0.23: Malicious npm security report (Block) | LPM Firewall

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

config/index.js hard-codes creator WhatsApp identities independent of installer configuration.
parser.js marks messages from those identities as isCreator on every installation.
messageHandler.js explicitly permits that hard-coded creator to run creator plugins on any installed bot.
filemanager.js lets creator commands read, overwrite, and archive files across the resolved shared project root.
creator.js lets the same remote identity run `pm2 restart all`, executing newly written project code.
start.js can send message previews and sender numbers to a fixed Telegram chat when its token variable is set.

Evidence against

preinstall only acts on Termux and installs declared native build prerequisites.
No install-time credential harvesting or external AI-agent configuration mutation was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 87 file(s), 1.46 MB of source, external domains: 1337x.to, 9convert.com, agatz.xyz, aiodownloader.com, aiovideodl.com, allstars-apis.vercel.app, api.adviceslip.com, api.agatz.xyz, api.aggelos-007.xyz, api.akuari.my.id, api.allorigins.win, api.bochilgaming.xyz, api.chucknorris.io, api.clipgrab.de, api.cobalt.tools, api.coingecko.com, api.dictionaryapi.dev, api.fadiapi.com, api.ferryhax.my.id, api.fgmods.xyz, api.gifmei.com, api.giftedtech.co.ke, api.github.com, api.gudangapi.com, api.ifeelmystic.com, api.igram.world, api.itzpire.site, api.jikan.moe, api.kanye.rest, api.lolhuman.xyz, api.lyrics.ovh, api.meongapi.my.id, api.mrfrankofc.gleeze.com, api.mymemory.translated.net, api.nasa.gov, api.ndevapi.com, api.nexoracle.com, api.noxinfluencer.com, api.nyxs.pw, api.openai4.workers.dev, api.openweathermap.org, api.otakugifs.xyz, api.paxsenix.biz.id, api.piped.yt, api.popcat.xyz, api.princeapi.my.id, api.princetechn.com, api.rankify.one, api.remove.bg, api.resso.app

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/ensure-termux-deps.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/commands/tools.jsView file

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

High Secret

Package contains a high-severity secret pattern.

src/commands/tools.jsView on unpkg · L509

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.22 matchedPath = src/commands/tools.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/tools.jsView on unpkg

509patternName = google_api_key severity = high line = 509 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/tools.js

src/commands/tools.jsView on unpkg · L509

start.jsView file

1'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

start.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

start.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.main -> start.js L1: 'use strict'; L2: require('dotenv').config({ path: require('path').join(__dirname, 'config.env') }); L3: ... L55: const cfg = require('./config'); L56: const axios = require('axios'); L57: const path = require('path'); ... L257: // ── Channel ad-reply contextInfo (looks like sent from channel) ── L258: const _CHANNEL_URL = process.env.AUTO_JOIN_CHANNEL || 'https://whatsapp.[redacted]'; L259: const _CHANNEL_THUMB = global.SL_AURA_THUMB || AURA_THUMB_PATH; ... L263: title: 'SL AURA', L264: body: '® ASTRAL CORE', L265: thumbnailUrl: _CHANNEL_THUMB,

src/media/startup_voice.oggView file

•path = src/media/startup_voice.ogg kind = high_entropy_blob sizeBytes = 387966 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/media/startup_voice.oggView on unpkg

src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.22 matchedPath = src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/extra_media.jsView on unpkg

33patternName = google_api_key severity = high line = 33 matchedText = const ur...)}`;

High

Secret Pattern

Google API key in src/commands/extra_media.js

src/commands/extra_media.jsView on unpkg · L33

src/commands/myfunc2.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.22 matchedPath = src/commands/myfunc2.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/myfunc2.jsView on unpkg

src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.22 matchedPath = src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/sticker.jsView on unpkg

src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.22 matchedPath = src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.22 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/unity_dl.jsView on unpkg