Loading npm security reports…

@eryxenx/fca@1.1.1: Malicious npm security report (Block) | LPM Firewall

registry / @eryxenx/fca / 1.1.1

@eryxenx/fca@1.1.1

Facebook Chat API by EryXenX | Stable • Auto Re-login • Full E2EE Support — with Command Anti-Spam (Humanizer)

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Calling the login API with Facebook credentials sends those credentials to a package-selected third-party server. The returned cookies can become the caller's Facebook session.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A consumer calls the exported login function with an email and password, or enables automatic login with credentials in fca-config.json.

Impact

A third party can receive Facebook passwords, optional two-factor secrets, and issue session cookies or access tokens.

Mechanism

Credential forwarding to a third-party login service followed by session-cookie installation.

Attack narrative

The package exposes a normal Facebook login interface, but its credential path forwards the supplied email, password, and optional two-factor secret to minhdong.site. It accepts cookies and tokens returned by that server, then installs the cookies into its Facebook session jar. This gives the third-party service both account credentials and a path to provide or control an authenticated session.

Rationale

This is concrete credential exfiltration to a package-selected third-party endpoint during normal runtime login. The absence of install hooks does not remove the risk to consumers who authenticate through the package.

Evidence

module/config.jsmodule/login.jsmodule/loginHelper.jssrc/api/socket/core/getSeqID.jsfca-config.json

Network endpoints1

/api/v1/facebook/login_ios

Source & flagged code

13 flagged · loading source

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

80// eslint-disable-next-line no-new-func L81: return new Function("s", "return import(s)")(specifier); L82: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/native/nativeMediaBridge.jsView on unpkg · L80

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = module/loginHelper.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @eryxenx/fca@1.0.6 matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.6 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

module/config.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = module/config.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

Source & flagged code

13 flagged

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

Lines 283-323javascript

283 "kyc-id",

284 "privacy_token",

285 "readreceipts",

286 "appointment_only",

287 "address",

288 "expected_ts",

289 "privacy",

290 "7",

291 "android",

292 "interactive",

293 "device-identity",

294 "enabled",

295 "attribute_padding",

296 "1080",

297 "03",

298 "screen_height"

299];

300var DoubleByteTokens = [

301 ["read-self", "active", "fbns", "protocol", "reaction", "screen_width", "heartbeat", "deviceid", "2:47DEQpj8", "uploadfieldstat", "voip_settings", "retry", "priority", "longitude", "conflict", "false", "ig_professional"

302 ["reject", "dirty", "announcement", "020", "13", "9", "status_video_max_bitrate", "fb:thrift_iq", "offline_batch", "022", "full", "ctwa_first_business_reply_logging", "h.264", "smax_id", "group_description_length", "https://www.whatsapp.com/otp/code", "status_image_max_edge"

303 ["64", "ptt_playback_speed_enabled", "web_product_list_message_enabled", "paid_convo_ts", "27", "manufacturer", "psp-routing", "grp_uii_cleanup", "ptt_draft_enabled", "03c", "business_initiated", "web_catalog_products_onoff", "web_upload_link_thumb_mms_enabled", "03e", "mediaretry", "35",

304 ["1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746", "pricing_model", "056", "059", "061", "1119", "6027", "65", "877",

305];

306var TokenToIndex = {};

307SingleByteTokens.forEach((token, idx) => {

308 if (token) TokenToIndex[token] = idx;

309});

310var DoubleTokenToIndex = {};

311DoubleByteTokens.forEach((dict, dictIdx) => {

312 dict.forEach((token, tokenIdx) => {

313 if (token) DoubleTokenToIndex[token] = { dict: dictIdx, index: tokenIdx };

314 });

315});

316

317// src/e2ee/transport/binary/decoder.ts

318var import_node_zlib = require("node:zlib");

319var BinaryDecoder = class {

320 data;

321 index = 0;

322 constructor(data) {

323 this.data = data;

Long lines were clipped for display.

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

Lines 60-100javascript

60}

61

62/**

63 * Wraps a native-engine call with a hard timeout. A hung native call (e.g.

64 * a stuck getDeviceList/usync query) was observed blocking the whole

65 * process — including the unrelated MQTT connection — for 80+ seconds,

66 * taking down the entire bot (all threads, not just the one send). This

67 * makes any single native call fail fast instead of hanging indefinitely.

68 */

69function

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @eryxenx/fca@1.0.6 matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.6 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

module/config.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = module/config.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg