Loading npm security reports…

cortana-md-engine: Malicious npm security report (Block) | LPM Firewall

registry / cortana-md-engine / 1.4.6

cortana-md-engine@1.4.6

CORTANA MD WhatsApp Bot — Self-Hosted Edition

OSV Malicious Advisory

imported 8d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17323 confirms this npm version as malicious. cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five mongodb+srv://cortanauser:...@{cluster2.uvds2qk,cluster3.t2gtazm,cluster4.bwuctn9,cluster5.kdkad04,mass.gcijtck}.mongodb.net Atlas connection strings and, at bot startup, persist the Baileys authState/creds (Session/authState/sessions collections) into those clusters...

Advisory

MAL-2026-17323

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in cortana-md-engine (npm)

Details

cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five mongodb+srv://cortanauser:...@{cluster2.uvds2qk,cluster3.t2gtazm,cluster4.bwuctn9,cluster5.kdkad04,mass.gcijtck}.mongodb.net Atlas connection strings and, at bot startup, persist the Baileys authState/creds (Session/authState/sessions collections) into those clusters. The MongoDB user credentials are baked into the shipped JavaScript, so the author retains read access to every installer's linked WhatsApp session state — sufficient to hijack the linked WhatsApp account. The relay is not disclosed in the README, which only instructs the user to run npm start. The tarball additionally ships offensive tooling aimed at third-party WhatsApp users (a ~150-entry proxy pool in dist/proxies.cjs, batched reaction and socket-spoof flooding in dist/react-engine.cjs, and abuse commands such as perm-ban-num, cortana-ios-crash, realban, massreport); this is operator-directed abuse capability, separate from the installer-side session exfiltration.

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory PACKAGE

Source & flagged code

12 flagged

dist/hosted.cjsView file

1505patternName = google_api_key severity = high line = 1505

High

High Secret

Package contains a high-severity secret pattern.

dist/hosted.cjsView on unpkg · L1505

1188\u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L1189: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await DD();if(!i)return t("\u274C Failed to authenticate wi... L1190:

High

Child Process

Package source references child process execution.

dist/hosted.cjsView on unpkg · L1188

1182L1183: > Downloaded via Cortana MD Premium`,contextInfo:{externalAdReply:{title:u.title||c,body:"CORTANA MD | VIDEO DOWNLOADER",thumbnailUrl:u.thumbnail,mediaType:2,showAdAttribution:!1,s... L1184: ... L1188: \u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L1189: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await DD();if(!i)return t("\u274C Failed to authenticate wi... L1190:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hosted.cjsView on unpkg · L1182

1505patternName = google_api_key severity = high line = 1505

High

Secret Pattern

Google API key in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L1505

6) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(a);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);va.write(px.format.apply(px,e))}}Object.defineProperty(sr.exports,"isWin",{get:function(){return _c},set:function(t){_c=t}});sr.exports.warnTo=function(t){var e=va;return va=t,e...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted.cjsView on unpkg · L6

1126patternName = generic_password severity = medium line = 1126

Medium

Secret Pattern

Hardcoded password in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L1126

1"use strict";var lk=Object.create;var Mo=Object.defineProperty;var uk=Object.getOwnPropertyDescriptor;var dk=Object.getOwnPropertyNames;var mk=Object.getPrototypeOf,fk=Object.proto... L2: CREATE TABLE IF NOT EXISTS ${T.identifier(i)}.${T.identifier(s)} ( ... L6: ) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(a);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);va.write(px.format.apply(px,e))}}Object.defineProperty(sr.exports,"isWin",{get:function(){return _c},set:function(t){_c=t}});sr.exports.warnTo=function(t){var e=va;return va=t,e... L9: <div class="wall-scrim"></div> ... L375: if (legacyCopy(text)) return Promise.resolve(true); L376: if (navigator.clipboard && navigator.clipboard.write

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hosted.cjsView on unpkg · L1

dist/index.cjsView file

1"use strict";var r5=Object.create;var Pu=Object.defineProperty;var a5=Object.getOwnPropertyDescriptor;var i5=Object.getOwnPropertyNames;var s5=Object.getPrototypeOf,o5=Object.proto... L2: at `+t[n].toString();return e}function f5(t){if(!t)throw new TypeError("argument namespace is required");var e=Iu(),n=ms(e[1]),r=n[0];function a(i){Nu.call(a,i)}return a._file=r,a.... L3: `,"utf8")}}}function ms(t){var e=t.getFileName()||"<anonymous>",n=t.getLineNumber(),r=t.getColumnNumber();t.isEval()&&(e=t.getEvalOrigin()+", "+e);var a=[e,n,r];return a.callSite=t... L4: at `+n[i].toString();return a}return e&&(a+=" at "+Um(e)),a}function v5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";retu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L1

4at `+n[i].toString();return a}return e&&(a+=" at "+Um(e)),a}function v5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";return r}return e&&(r+=" \x1B[36m"+Um(e)+"\x1B[39m"),r}function Um(t){return c5(l5,t[0])+":"+t[1]+":"+t[2]}function Iu(){var t=Error.stackTr... L6: return function (`+n+`) {log.call(deprecate, message, site)

High

Eval

Package source references dynamic code evaluation.

dist/index.cjsView on unpkg · L4