Loading npm security reports…

@cexy/wonfca@1.1.3: Malicious npm security report (Block) | LPM Firewall

registry / @cexy/wonfca / 1.1.3

@cexy/wonfca@1.1.3

Unofficial Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Login and default session recovery post Facebook email, password, and 2FA to https://minhdong.site/api/v1/facebook/login_ios. The example config names a different host, so omitting apiServer still sends secrets to the compiled minhdong.site receiver.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Calling login, loginViaAPI, or tokensViaAPI, or automatic session recovery when autoLogin stays on and credentials are present in fca-config.json.

Impact

The operator of minhdong.site can capture Facebook passwords, 2FA secrets, and returned session cookies.

Mechanism

Default unofficial credential gateway

Attack narrative

This package presents itself as an unofficial Messenger client, but compiled defaults send Facebook login secrets to minhdong.site. When a user logs in through the API helpers, or when a session lacks a valid user id and autoLogin remains on, email, password, and 2FA are posted to /api/v1/facebook/login_ios. The example config points at donixdev.com, so a cloned config that fills credentials but leaves apiServer unset follows the hidden default. There is no install hook; the theft happens at login and recovery time.

AI rationale

Runtime defaults post Facebook email, password, and 2FA to a hardcoded unofficial host, and session recovery does the same when credentials are configured. The example config names a different gateway, which is a credential redirect rather than a Facebook-aligned client.

Evidence

dist/index.jsdist/index.mjsfca-config.example.jsonfca-config.json

Network endpoints3

Source & flagged code

8 flagged · loading source

dist/index.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. dist/index.js: isVoiceMail: blob.is_voicemail hasEmailParticipant: data.has_email_participant, const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ... autoLogin: true, credentials: { email: "", password: "", twofactor: "" }, hasEmailParticipant: false, isVoiceMail: attachment.is_voicemail author_email: "",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg

5501return new Promise((resolve, reject) => { L5502: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => { L5503: if (error) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5501

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L36

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.9 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fe87d011538dade4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @cexy/wonfca@1.1.9 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.9 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs.writeFileSync(targetPath, payload, "utf8"); const url2 = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com... return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || ""; fs2.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8"); const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`; urlBase: baseUrl, urlBase: baseUrl, headers: token ? { Authorization: `Bearer ${token}` } : void 0

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.9 matchedPath = dist/index.mjs matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

8 flagged

dist/index.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. dist/index.js: isVoiceMail: blob.is_voicemail hasEmailParticipant: data.has_email_participant, const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ... autoLogin: true, credentials: { email: "", password: "", twofactor: "" }, hasEmailParticipant: false, isVoiceMail: attachment.is_voicemail author_email: "",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg

5501return new Promise((resolve, reject) => { L5502: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => { L5503: if (error) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5501

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L36

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.9 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fe87d011538dade4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @cexy/wonfca@1.1.9 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.9 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs.writeFileSync(targetPath, payload, "utf8"); const url2 = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com... return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || ""; fs2.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8"); const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`; urlBase: baseUrl, urlBase: baseUrl, headers: token ? { Authorization: `Bearer ${token}` } : void 0

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.9 matchedPath = dist/index.mjs matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg