registry / Malware / rimuru-md

rimuru-md

WhatsApp Multi-Device Bot dengan sistem plugin modular

This report shows the evidence for rimuru-md@3.3.0, the only known version.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source inspection confirms an automatic, publisher-selected account action on connection, without a user command or affirmative consent. This is concrete unauthorized account behavior and warrants blocking.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The WhatsApp connection opens and the local completion marker is absent.

Impact

The linked WhatsApp account is subscribed to the selected newsletter.

Mechanism

A delayed routine calls the socket’s newsletter follow operation for a fixed newsletter identifier.

Attack narrative

On startup, the package connects to WhatsApp. After the connection opens, it checks for a local completion marker and, if absent, schedules a follow action for a fixed newsletter. The action is not tied to a user command or an affirmative opt-in, so it changes the connected account’s subscriptions automatically.

AI rationale

Evidence

package.jsonindex.jssrc/connection.jssrc/lib/rimuru-channels.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package uses index.js as its main entry point.
index.js starts the WhatsApp connection during application startup.
When the WhatsApp connection opens, src/connection.js activates an automatic action routine if a local marker is absent.
That routine follows a fixed newsletter without a user command or an affirmative opt-in check.
The fixed newsletter identifier is also listed in src/lib/rimuru-channels.js; its group invite list is empty.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,685 file(s), 12.1 MB of source, external domains: 02.ikiru.wtf, 0x0.st, 5mb.link, 8upload.com, a.top4top.io, aha-music.com, aichatfree.info, air.vunime.my.id, albyoffc.my.id, aliceecdn.vercel.app, alight.link, alkitab.me, allinonedownloader.com, am.rafaelxd.my.id, an1.com, anabot.my.id, ani-station-schedule-api.vercel.app, anichin.cafe, anilist.co, animechan.xyz, apa2.cekresi.com, api-abztech.zone.id, api-faa.my.id, api-pddikti.kemdiktisaintek.go.id, api-uc.wallpaperscraft.com, api-xemoz-official.my.id, api.aladhan.com, api.alquran.cloud, api.apocalypse.web.id, api.azbry.com, api.baguss.xyz, api.boostfluence.com, api.chatgot.io, api.cmnty.eu.cc, api.covenant.sbs, api.cuki.biz.id, api.dashx.dpdns.org, api.deline.web.id, api.denayrestapi.xyz, api.digitalocean.com, api.doreso.com, api.dotgg.gg, api.duniagames.co.id, api.emiliabot.my.id, api.example.com, api.exchangerate-api.com, api.ezremove.ai, api.freeconvert.com, api.fstik.app, api.gimita.id

Source & flagged code

14 flagged

plugins/search/tenor.jsView file

Lines 89-129javascript

89 title: r.title || r.h1_title || r.long_title || '',

90 author: r.user || null,

91 page_url: r.url || r.itemurl || '',

92 tags: Array.isArray(r.tags) ? r.tags : [],

93 content_rating: r.content_rating || '',

94 hasaudio: Boolean(r.hasaudio),

95 created: r.created || null,

96 playable_url,

97 media: {

98 type: meta.type,

99 duration: meta.duration,

100 size: meta.size

101 }

102 }

103}

104

105async function searchTenor(query) {

106 const params = {

107 appversion: 'browser-r20251209-1',

108 prettyPrint: 'false',

109 key: 'AIzaSyC-P6_qz3FzCoXGLk6tgitZo4jEJ5mLzD8',

High

High Secret

Package contains a high-severity secret pattern.

plugins/search/tenor.jsView on unpkg · L109

110 client_key: 'tenor_web',

111 locale: 'es_US',

112 anon_id: 'AAZHDntgcvcI5Qq9XzSEuQ',

113 q: query,

114 limit: '50',

115 contentfilter: 'low',

116 media_filter: 'gif,gif_transparent,mediumgif,tinygif,tinygif_transparent,webp,webp_transparent,tinywebp,tinywebp_transparent,tinymp4,mp4,webm,originalgif,gifpreview',

117 fields: [

118 'next',

119 'results.id',

120 'results.media_formats',

121 'results.title',

122 'results.h1_title',

123 'results.long_title',

124 'results.itemurl',

125 'results.url',

126 'results.created',

127 'results.user',

128 'results.tags',

129 'results.content_rating',

109patternName = google_api_key severity = high line = 109

High

Secret Pattern

Google API key in plugins/search/tenor.js

plugins/search/tenor.jsView on unpkg · L109

plugins/music/play3.jsView file

Lines 10-50javascript

10│ 👤 Developer : 𝑯𝒚𝒖𝒖 / 𝒁𝒂𝒏𝒏

11│ 🎵 TikTok : https://tiktok.com/@ourinmd

12│ 📢 WhatsApp : https://whatsapp.com/channel/0029VbB37bgBfxoAmAlsgE0t

13╰─────────────────────────────────────────────╯

15╭────────────「 ✦ 𝑰𝑵𝑭𝑶

plugins/owner/restart.jsView file

Lines 54-94javascript

54 await sock.sendMessage(m.chat, {

55 text: `🔄 *ʀᴇsᴛᴀʀᴛɪɴɢ ʙᴏᴛ...*\n\n` +

56 `╭┈┈⬡「 📊 *ɪɴꜰᴏ* 」\n` +

57 `┃ ⏰ Time: ${new Date().toLocaleTimeString

plugins/tools/calc.jsView file

Lines 59-94javascript

59 let val = text

60 .replace(/[^0-9\-\/+*×÷πEe()#^√]/g, '')

61 .replace(/×/g, '*')

plugins/owner/enableplugin.jsView file

Lines 40-80javascript

40 isPremium: false,

41 isGroup: false,

42 isPrivate: false,

43 cooldown: 3,

44 energi:

plugins/economy/ceksn.jsView file

Lines 1-30javascript

1/*

2╔══════════════════════════════════════════════╗

3║ 👑 𝑹𝑰𝑴𝑼𝑹𝑼 𝑴𝑫 〽️ ║

4╚══════════════════════════════════════════════╝

6🪽 𝑵𝒐𝒕𝒆 :

7Rimuru MD adalah SC hasil rename dari SC Ourin MD.

9╭─────────────「 🜲 𝑰𝑵𝑭𝑶 𝑶𝑼𝑹𝑰𝑵 」─────────────╮

10│ 👤 Developer : 𝑯𝒚𝒖𝒖 / 𝒁𝒂𝒏𝒏

11│ 🎵 TikTok : https://tiktok.com/@ourinmd

plugins/tools/weather.jsView file

Lines 1-25javascript

1/*

2 Fitur tambahan hasil audit FURINA V17 → Rimuru MD.

3 Weather card menggunakan asset Poppins + background cache lokal.

4*/

6import axios from 'axios'

7import { createCanvas, loadImage, GlobalFonts } from '@napi-rs/canvas'

8import { existsSync } from

plugins/canvas/quoteswindows.jsView file

Lines 10-50javascript

10│ 👤 Developer : 𝑯𝒚𝒖𝒖 / 𝒁𝒂𝒏𝒏

11│ 🎵 TikTok : https://tiktok.com/@ourinmd

12│ 📢 WhatsApp : https://whatsapp.com/channel/0029VbB37bgBfxoAmAlsgE0t

13╰─────────────────────────────────────────────╯

15╭────────────「 ✦ 𝑰𝑵𝑭𝑶

plugins/owner/updatescript.jsView file

219try { L220: execSync('npm install --production', { L221: cwd: baseDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

plugins/owner/updatescript.jsView on unpkg · L219

plugins/download/dailymotiondl.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

plugins/download/dailymotiondl.js#virtual:normalized:round1View on unpkg

plugins/ai/artaai.jsView file

48patternName = google_api_key severity = high line = 48

High

Secret Pattern

Google API key in plugins/ai/artaai.js

plugins/ai/artaai.jsView on unpkg · L48

config.jsView file

313patternName = google_api_key severity = high line = 313

High

Secret Pattern

Google API key in config.js

config.jsView on unpkg · L313

src/lib/rimuru-import/lib/youtube.jsView file

270patternName = google_api_key severity = high line = 270

High

Secret Pattern

Google API key in src/lib/rimuru-import/lib/youtube.js

src/lib/rimuru-import/lib/youtube.jsView on unpkg · L270

Source & flagged code

14 flagged · loading source

plugins/search/tenor.jsView file

109patternName = google_api_key severity = high line = 109

High

High Secret

Package contains a high-severity secret pattern.

plugins/search/tenor.jsView on unpkg · L109

109patternName = google_api_key severity = high line = 109

High

Secret Pattern

Google API key in plugins/search/tenor.js

plugins/search/tenor.jsView on unpkg · L109

plugins/music/play3.jsView file

30import { createDecipheriv, randomUUID } from 'node:crypto' L31: import { spawn } from 'node:child_process' L32: import yts from 'yt-search'

High

Child Process

Package source references child process execution.

plugins/music/play3.jsView on unpkg · L30

Findings

1 Critical10 High4 Medium6 Low

CriticalTrojan Source Unicodeplugins/canvas/quoteswindows.js

HighHigh Secretplugins/search/tenor.js

HighChild Processplugins/music/play3.js

HighShellplugins/owner/restart.js

HighCredential Exfiltrationplugins/tools/weather.js

HighRuntime Package Installplugins/owner/updatescript.js

HighSemantic Analysis Limitedplugins/download/dailymotiondl.js#virtual:normalized:round1

HighSecret Patternplugins/search/tenor.js

HighSecret Patternplugins/ai/artaai.js

HighSecret Patternconfig.js

HighSecret Patternsrc/lib/rimuru-import/lib/youtube.js

Medium

Affected versions and remediation

This report applies to rimuru-md@3.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing rimuru-md@3.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-17 11:01:09.966Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

3.3.0latestshownMaliciousMalwareBlockPublishedOct 10, 2026, 1:34 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code