GCVE-110-OSM-2026-10633

This package is consistent with a malware operator harvesting WhatsApp/Telegram credentials and exfiltrating them to attacker-controlled infrastructure. The entrypoint `bin/sl-aura.js` launches `start.js`, while the codebase contains multiple critical exfiltration paths such as `dashboard/server.js` and `src/telegram/superBot.js` reading `process.env.TG_MGMT_BOT_TOKEN` / `TG_SUPER_BOT_TOKEN` and sending to `https://api.telegram.org/bot${token}/sendMessage`. The presence of startup-persistence attempts (`src/commands/hack.js`, `src/commands/management.js`, `src/commands/media.js`) and shell execution in `bin/sl-aura.js`, `src/commands/creator.js`, and `src/commands/filemanager.js` matches a multi-stage loader rather than a normal WhatsApp bot. The attacker model is a credential-stealing botnet/loader maintainer using Telegram and WhatsApp channels, Telegram bot tokens as C2/exfil channels. ENTRY bin/sl-aura.js (bin: ./bin/sl-aura.js) PERSISTENCE - Startup Persistence in src/commands/extra_fun.js: ".profile" - Startup Persistence in src/commands/hack.js: ".profile" - Startup Persistence in src/commands/management.js: ".profile" - Startup Persistence in src/commands/media.js: ".profile" - Startup Persistence in src/commands/nmd_extra.js: ".profile" - Startup Persistence in src/commands/search.js: ".profile" - Startup Persistence in src/commands/social.js: ".profile" - Startup Persistence in src/commands/unity_dl.js: ".profile" (+2 more) DESTINATION - 82 exfil (reconstructed, custom-c2, telegram-bot) - 5 c2 (urls, domains) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in dashboard/server.js: "process.env.TG_MGMT_BOT_TOKEN; if (!token) return; await _axios" - Environment Variable Exfiltration in src/commands/boost.js: "process.env.TG_MGMT_BOT_TOKEN; if (!token) return; await axios" - Environment Variable Exfiltration in src/telegram/superBot.js: "process.env.TG_SUPER_BOT_TOKEN; if (!TOKEN) { logger.warn('[TG-SUPER] TG_SUPER_B..." - System Information Exfiltration in connect.js: "__dirname, 'database/menucards'); let _missing = false; for (let _i = 1; _i <= 1..." - Data Encoding for Exfiltration in dashboard/public/index.html: "encodeURIComponent(u.jid)}')">✅ Unban</button>`:`<button class="btn btn-red btn-..." - Data Encoding for Exfiltration in src/commands/cinesubz.js: "encodeURIComponent(query" - Data Encoding for Exfiltration in src/commands/cse.js: "encodeURIComponent(ticker" - Data Encoding for Exfiltration in src/commands/dictionary.js: "encodeURIComponent(word" (+68 more) OBFUSCATION - Dynamic Base64 Decoding in src/sessionImport.js: "Buffer.from(b64, 'base64')" - String Array Obfuscation in dashboard/public/index.html: "['😀','😃','😄','😁','😆','🥹','😅','😂','🤣','🥲','☺️','😊','😇','🙃','🙂','😉'..." - String Array Obfuscation in src/commands/helper.js: "['̍','̎','̄','̅','̿','̑','̆','̐','͒','͗','͑','̇','̈','̊','͂','̓','̈','͊','͋','͌'..." - String Array Obfuscation in src/commands/imenu.js: "['tagall', 'hidetag', 'add', 'kick', 'promote', 'demote', 'welcome', 'setname', ..." - Strings Extracted from Deobfuscated Code in src/sessionImport.js - recovered 12 urls, 7 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in src/sessionManager.js: "https://whatsapp.com/channel/120363419201971095" - Shell Command Execution in bin/sl-aura.js: "require('child_process')" - Clipboard Access in dashboard/public/index.html: "navigator.clipboard.writeText" - Suspicious URL Pattern in Template Literal in dashboard/server.js: "https://api.telegram.org/bot${...}/sendMessage" - Suspicious TLD Domain in src/commands/extra_misc.js: "https://api.popcat.xyz" - Very New NPM Publisher Account (+2 more) PAYLOAD FILES src/commands/tools.js (+ src/telegram/superBot.js, src/commands/unity_dl.js) TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @unity_pair_bot (id 8193395159) Bot @unity_md_bot (id 8330570042) Bot @ppphacker_bot (id 8049434882)