@astralcore/aura-wb@1.0.32: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@astralcore/aura-wb@1.0.32: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.preinstall = node dist/scripts/ensure-termux-deps.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node dist/scripts/ensure-termux-deps.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/commands/tools.jsView file

1patternName = google_api_key severity = high line = 1 matchedText = "use str...}}};

High

High Secret

Package contains a high-severity secret pattern.

dist/src/commands/tools.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/tools.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/tools.jsView on unpkg

1patternName = google_api_key severity = high line = 1 matchedText = "use str...}}};

High

Secret Pattern

Google API key in dist/src/commands/tools.js

dist/src/commands/tools.jsView on unpkg · L1

dist/start.jsView file

1"use strict";require("dotenv").config({path:require("path").join(__dirname,"config.env")});const _origConsoleLog=console.log.bind(console),_NOISY_PATTERNS=[/^Closing session:/,/^Re...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/start.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/start.js L1: "use strict";require("dotenv").config({path:require("path").join(__dirname,"config.env")});const _origConsoleLog=console.log.bind(console),_NOISY_PATTERNS=[/^Closing session:/,/^Re...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/start.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.main -> dist/start.js L1: "use strict";require("dotenv").config({path:require("path").join(__dirname,"config.env")});const _origConsoleLog=console.log.bind(console),_NOISY_PATTERNS=[/^Closing session:/,/^Re...

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/start.jsView on unpkg · L1

1

dist/src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/extra_media.jsView on unpkg

1patternName = google_api_key severity = high line = 1 matchedText = "use str...0}};

High

Secret Pattern

Google API key in dist/src/commands/extra_media.js

dist/src/commands/extra_media.jsView on unpkg · L1

dist/src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/sticker.jsView on unpkg

dist/src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/unity_dl.jsView on unpkg

dist/src/commands/unity_extra.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/unity_extra.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/unity_extra.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "@astralcore/aura-wb",

3 "version": "1.0.32",

4 "description": "AURA — WhatsApp bot (npm/yarn package build)",

5 "main": "dist/start.js",

6 "bin": {

7 "aura-wb": "dist/bin/aura-wb.js"

8 },

9 "type": "commonjs",

10 "scripts": {

11 "preinstall": "node dist/scripts/ensure-termux-deps.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "start": "node dist/bin/aura-wb.js",

13 "build": "node scripts/build.js",

14 "prepublishOnly": "npm run build"

15 },

16 "engines": {

17 "node": ">=18.0.0"

18 },

19 "publishConfig": {

20 "access": "public"

21 },

22 "files": [

23 "dist",

24 "LICENSE"

25 ],

26 "devDependencies": {

27 "terser": "^5.31.0"

28 },

29 "dependencies": {

30 "@ffmpeg-installer/ffmpeg": "latest",

31 "@ffprobe-installer/ffprobe": "latest",

dist/src/commands/tools.jsView file

Lines 1-1javascript

1"use strict";const{t:t,getLang:getLang}=require("../lang"),axios=require("axios"),QRCode=require("qrcode"),{

dist/start.jsView file

Lines 1-1javascript

1"use strict";require("dotenv").config({path:require("path").join(__dirname,"config.env")});const _origConsoleLog=console.log.bind(console),_NOISY_PATTERNS=[/^Closing session:/

dist/src/commands/extra_media.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/extra_media.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/extra_media.jsView on unpkg

1patternName = google_api_key severity = high line = 1 matchedText = "use str...0}};

High

Secret Pattern

Google API key in dist/src/commands/extra_media.js

dist/src/commands/extra_media.jsView on unpkg · L1

dist/src/commands/sticker.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/sticker.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/sticker.jsView on unpkg

dist/src/commands/unity_dl.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/unity_dl.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/unity_dl.jsView on unpkg

dist/src/commands/unity_extra.jsView file

•matchType = normalized_sha256 matchedPackage = @astralcore/aura-wb@1.0.31 matchedPath = dist/src/commands/unity_extra.js matchedIdentity = npm:QGFzdHJhbGNvcmUvYXVyYS13Yg:1.0.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/commands/unity_extra.jsView on unpkg