Critical Vulnerability in cortana-md-engine: Malicious Code Exposed
Summary
MAL-2026-17323: Malicious code in cortana-md-engine (npm). Affects cortana-md-engine versions 1.4.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cortana-md-engine is a Baileys-based WhatsApp bot designed to automate interactions on the WhatsApp platform. It features bundled entry points that facilitate user engagement through various automated tasks. However, this package has been found to contain hardcoded MongoDB connection strings and malicious tooling aimed at exploiting WhatsApp users, making it highly vulnerable to abuse and unauthorized access.
Vulnerability Detail
The vulnerability originates from the hardcoded MongoDB connection strings embedded within the package's code. These strings allow the package author to maintain read access to the WhatsApp session states of all users who install the package. This access can lead to account hijacking, as the author can exploit the stored authentication states. Additionally, the package includes offensive tools designed for abuse, such as proxy pools and commands for mass reporting and account banning, further exacerbating the risk to users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cortana-md-engineIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid using the cortana-md-engine package until a secure version is released. Additionally, consider using alternative WhatsApp automation tools that do not contain known vulnerabilities.
Conclusion
The cortana-md-engine package contains a critical vulnerability that exposes users to potential account hijacking and abuse. It is essential for users to update or remove the package and remain vigilant about their account security. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for cortana-md-engine →
FAQ
cortana-md-engine is a WhatsApp bot that automates user interactions on the platform, but it has been found to contain malicious code.
The vulnerability allows the package author to access users' WhatsApp session states, potentially leading to account hijacking.
If you have installed this package, it is recommended to uninstall it immediately and monitor your WhatsApp account for any suspicious activity.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The package includes tools for proxy management, mass reporting, and account banning, which can be used maliciously against other WhatsApp users.
