The npm package @astralcore/aura-wb is a WhatsApp bot that contains malicious code which exfiltrates sensitive WhatsApp session credentials to a hardcoded, author-controlled MongoDB Atlas cluster. The package writes full WhatsApp credentials and signal keys to this shared database, allowing the author or anyone with access to the database to fully control the installer's WhatsApp account. Additionally, the package polls the shared database to receive commands that can manipulate the installer's WhatsApp session to follow, react to, or read arbitrary channels. The package also sends host environment information to a hardcoded Telegram chat ID, providing the author with deployment notifications. A Google Tenor API key is embedded as well. The affected versions are 1.0.0, 1.0.1, and 1.0.4. No patch or remediation information is provided.