@astralcore/aura-wb (npm) · Malicious Code
Affects @astralcore/aura-wbSource GCVE Database
Malicious package : remove @astralcore/aura-wb and rotate any secrets on hosts that installed it.
Data as of 6 Aug 2026, 18:34 UTC
Malicious package
Published to npm · OSV MAL-2026-13413
What to do
Remove @astralcore/aura-wb from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@astralcore/aura-wb | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @astralcore/aura-wb is a WhatsApp bot that contains malicious code which exfiltrates sensitive WhatsApp session credentials to a hardcoded, author-controlled MongoDB Atlas cluster. The package writes full WhatsApp credentials and signal keys to this shared database, allowing the author or anyone with access to the database to fully control the installer's WhatsApp account. Additionally, the package polls the shared database to receive commands that can manipulate the installer's WhatsApp session to follow, react to, or read arbitrary channels. The package also sends host environment information to a hardcoded Telegram chat ID, providing the author with deployment notifications. A Google Tenor API key is embedded as well. The affected versions are 1.0.0, 1.0.1, and 1.0.4. No patch or remediation information is provided.