Loading npm security reports…

abir-fca@0.0.22: Malicious npm security report (Block) | LPM Firewall

registry / abir-fca / 0.0.22

abir-fca@0.0.22

Unofficial Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the package writes a configuration file in the consumer project. Calling login sends supplied Facebook credentials to a fixed third-party host and can automatically install another package.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing the package, then calling its login API with credentials.

Impact

Facebook credentials can be disclosed to minhdong.site, and the consumer project can be modified by an npm install.

Mechanism

Default credential relay and automatic npm installation.

Attack narrative

The manifest exposes dist/index.mjs. Its initialization loads configuration and creates fca-config.json if absent. Defaults enable updates, install them with npm in the current working directory, and select sagor-fca. When login is called, supplied email, password, and optional two-factor value are posted to a fixed minhdong.site endpoint before authentication proceeds. This combines credential disclosure with unprompted dependency mutation in the consumer project.

Rationale

The package contains concrete credential exfiltration to an unrelated fixed host and automatic consumer-project dependency installation enabled by default. These behaviors are reachable through normal package use and are not lifecycle-hook-only scanner noise.

Evidence

package.jsondist/index.mjsfca-config.jsonnode_modules/sagor-fca

Network endpoints2

minhdong.site/api/v1/facebook/login_ios

Source & flagged code

8 flagged · loading source

dist/index.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. dist/index.js: isVoiceMail: blob.is_voicemail hasEmailParticipant: data.has_email_participant, const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ... "application/vnd.omads-email+xml": { "application/vnd.seemail": { autoLogin: true, credentials: { email: "", password: "", twofactor: "" }, hasEmailParticipant: false,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg

15814return new Promise((resolve, reject) => { L15815: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => { L15816: if (error) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L15814

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L36

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = abir-fca@0.0.21 matchedPath = dist/index.js matchedIdentity = npm:YWJpci1mY2E:0.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 97a008962468d8f1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = abir-fca@0.0.21 matchedPath = dist/index.js matchedIdentity = npm:YWJpci1mY2E:0.0.21 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs.writeFileSync(configPath, payload, "utf8"); fs.writeFileSync(targetPath, payload, "utf8"); const url2 = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com... return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || ""; fs2.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8"); const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`; urlBase: baseUrl, urlBase: baseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = abir-fca@0.0.21 matchedPath = dist/index.mjs matchedIdentity = npm:YWJpci1mY2E:0.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

8 flagged

dist/index.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. dist/index.js: isVoiceMail: blob.is_voicemail hasEmailParticipant: data.has_email_participant, const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ... "application/vnd.omads-email+xml": { "application/vnd.seemail": { autoLogin: true, credentials: { email: "", password: "", twofactor: "" }, hasEmailParticipant: false,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg

15814return new Promise((resolve, reject) => { L15815: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => { L15816: if (error) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L15814

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L36

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = abir-fca@0.0.21 matchedPath = dist/index.js matchedIdentity = npm:YWJpci1mY2E:0.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 97a008962468d8f1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = abir-fca@0.0.21 matchedPath = dist/index.js matchedIdentity = npm:YWJpci1mY2E:0.0.21 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs.writeFileSync(configPath, payload, "utf8"); fs.writeFileSync(targetPath, payload, "utf8"); const url2 = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com... return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || ""; fs2.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8"); const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`; urlBase: baseUrl, urlBase: baseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = abir-fca@0.0.21 matchedPath = dist/index.mjs matchedIdentity = npm:YWJpci1mY2E:0.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg