The cortana-md-engine npm package contains hardcoded MongoDB credentials that allow the package author to access WhatsApp session data from installed bots. This access enables potential hijacking of linked WhatsApp accounts. Additionally, the package includes offensive tools for abuse against third-party WhatsApp users, such as proxy pools and commands for flooding and banning. The malicious functionality is not disclosed in the README, misleading users about the package's true behavior.