•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay.
dist/index.js:
isVoiceMail: blob.is_voicemail
hasEmailParticipant: data.has_email_participant,
const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ...
autoLogin: true,
credentials: { email: "", password: "", twofactor: "" },
hasEmailParticipant: false,
isVoiceMail: attachment.is_voicemail
author_email: "",
CriticalHardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg 5501return new Promise((resolve, reject) => {
L5502: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => {
L5503: if (error) {
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import_node_fs.default.writeFileSync(targetPath, payload, "utf8");
const url = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com"...
return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || "";
import_fs.default.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8");
const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`;
urlBase: baseUrl,
urlBase: baseUrl,
headers: token ? { Authorization: `Bearer ${token}` } : void 0
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg 36// src/func/logger.ts
L37: function writeStdout(message) {
L38: process.stdout.write(`${message}
L39: `);
...
L55: function getTheme() {
L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase();
L57: if (fromEnv === "minimal") return "minimal";
...
L135: const parts2 = parseLabel(message, "READY");
L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body);
L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label));
...
L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
L1526: const referer = options?.referer ||
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L36 36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution.
L36: // src/func/logger.ts
L37: function writeStdout(message) {
L38: process.stdout.write(`${message}
L39: `);
...
L55: function getTheme() {
L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase();
L57: if (fromEnv === "minimal") return "minimal";
...
L135: const parts2 = parseLabel(message, "READY");
L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body);
L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label));
...
L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L36 •matchType = normalized_sha256
matchedPackage = @cexy/wonfca@1.0.7
matchedPath = dist/index.js
matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
HighKnown Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg •matchType = malicious_source_fingerprint_signature
signature = 6985beb57461bf72
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @cexy/wonfca@1.0.7
matchedPath = dist/index.js
matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.7
similarity = 1.000
shingleOverlap = 4
summary = package final verdict is malicious
HighKnown Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkg