registry / Credential exfiltration / abir-fca
abir-fca
Unofficial Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically
This report shows the evidence for abir-fca@0.0.22. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains concrete credential exfiltration to an unrelated fixed host and automatic consumer-project dependency installation enabled by default. These behaviors are reachable through normal package use and are not lifecycle-hook-only scanner noise.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing the package, then calling its login API with credentials.
Impact
Facebook credentials can be disclosed to minhdong.site, and the consumer project can be modified by an npm install.
Mechanism
Default credential relay and automatic npm installation.
Attack narrative
The manifest exposes dist/index.mjs. Its initialization loads configuration and creates fca-config.json if absent. Defaults enable updates, install them with npm in the current working directory, and select sagor-fca. When login is called, supplied email, password, and optional two-factor value are posted to a fixed minhdong.site endpoint before authentication proceeds. This combines credential disclosure with unprompted dependency mutation in the consumer project.
AI rationale
The package contains concrete credential exfiltration to an unrelated fixed host and automatic consumer-project dependency installation enabled by default. These behaviors are reachable through normal package use and are not lifecycle-hook-only scanner noise.
Evidence
package.jsondist/index.mjsfca-config.jsonnode_modules/sagor-fca
Network endpoints2
minhdong.site/api/v1/facebook/login_iosregistry.npmjs.org
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest routes imports to the bundled runtime.
- Import-time initialization creates fca-config.json in the consumer working directory.
- The generated defaults enable automatic update installation and use an unrelated package name.
- The login helper posts supplied Facebook email and password to minhdong.site by default.
- A login call performs the configured update check before authenticating and can run npm install in the consumer project.
Evidence against
- There are no npm preinstall, install, or postinstall hooks.
- Remote control is disabled in the default configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcedist/index.jsView file
•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay.
dist/index.js:
isVoiceMail: blob.is_voicemail
hasEmailParticipant: data.has_email_participant,
const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ...
"application/vnd.omads-email+xml": {
"application/vnd.seemail": {
autoLogin: true,
credentials: { email: "", password: "", twofactor: "" },
hasEmailParticipant: false,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg15814return new Promise((resolve, reject) => {
L15815: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => {
L15816: if (error) {
High
36// src/func/logger.ts
L37: function writeStdout(message) {
L38: process.stdout.write(`${message}
L39: `);
...
L55: function getTheme() {
L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase();
L57: if (fromEnv === "minimal") return "minimal";
...
L135: const parts2 = parseLabel(message, "READY");
L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body);
L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label));
...
L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
L1526: const referer = options?.referer ||
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L3636Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution.
L36: // src/func/logger.ts
L37: function writeStdout(message) {
L38: process.stdout.write(`${message}
L39: `);
...
L55: function getTheme() {
L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase();
L57: if (fromEnv === "minimal") return "minimal";
...
L135: const parts2 = parseLabel(message, "READY");
L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body);
L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label));
...
L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L36•matchType = normalized_sha256
matchedPackage = abir-fca@0.0.21
matchedPath = dist/index.js
matchedIdentity = npm:YWJpci1mY2E:0.0.21
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 97a008962468d8f1
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = abir-fca@0.0.21
matchedPath = dist/index.js
matchedIdentity = npm:YWJpci1mY2E:0.0.21
similarity = 1.000
shingleOverlap = 5
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkgdist/index.mjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.mjs:
fs.writeFileSync(configPath, payload, "utf8");
fs.writeFileSync(targetPath, payload, "utf8");
const url2 = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com...
return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || "";
fs2.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8");
const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`;
urlBase: baseUrl,
urlBase: baseUrl,
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.mjsView on unpkg•matchType = normalized_sha256
matchedPackage = abir-fca@0.0.21
matchedPath = dist/index.mjs
matchedIdentity = npm:YWJpci1mY2E:0.0.21
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.mjsView on unpkgFindings
1 Critical8 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShell
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/index.mjs
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to abir-fca@0.0.22.
The versions list below shows the verdict for each recorded version.
- Avoid installing abir-fca@0.0.22. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.