Loading npm security reports…
AURA — WhatsApp bot (npm/yarn package build)
At runtime, inbound WhatsApp reactions cause message metadata and content excerpts to be sent to a hard-coded Telegram recipient. The package also has a Termux-only preinstall system-package installer.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
dist/src/commands/tools.jsView on unpkg · L1Google API key in dist/src/commands/tools.js
dist/src/commands/tools.jsView on unpkg · L1Source appears to send environment or credential material to an external endpoint.
dist/start.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/start.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/start.jsView on unpkg · L1Google API key in dist/src/commands/extra_media.js
dist/src/commands/extra_media.jsView on unpkg · L1Package source references dynamic require/import behavior.
dist/start.jsView on unpkg · L1Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L11Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L11Google API key in dist/src/commands/extra_media.js
dist/src/commands/extra_media.jsView on unpkg · L1Package contains a high-severity secret pattern.
dist/src/commands/tools.jsView on unpkg · L1Google API key in dist/src/commands/tools.js
dist/src/commands/tools.jsView on unpkg · L1Source appears to send environment or credential material to an external endpoint.
dist/start.jsView on unpkg · L1A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/start.jsView on unpkg · L1A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/start.jsView on unpkg · L1Package source references dynamic require/import behavior.
dist/start.jsView on unpkg · L1