registry / emonfca / 1.2.29

emonfca@1.2.29

Unofficial Facebook Chat API for Node.js with Auto-Update System - Enhanced by EMON | Emon Hawladar

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 124 file(s), 641 KB of source, external domains: 127.0.0.1, accountscenter.facebook.com, api.findids.net, api.imgbb.com, b-graph.facebook.com, business.facebook.com, facebook.com, github.com, graph.facebook.com, id.traodoisub.com, m.facebook.com, raw.githubusercontent.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, upload.imagekit.io, www.facebook.com, www.messenger.com

Source & flagged code

5 flagged

checkUpdate.jsView file

Lines 1-21javascript

1const axios = require('axios');

2const { execSync } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

4const path = require('path');

6function getCurrentVersion() {

7 // 1. If this file is inside the emonfca package itself (development mode), use its own package.json

8 try {

9 const ownPkg = path.join(__dirname, 'package.json');

10 if (fs.existsSync(ownPkg)) {

11 const pkg = JSON.parse(fs.readFileSync(ownPkg, 'utf-8'));

12 if (pkg.name === 'emonfca' && pkg.version) return pkg.version;

13 }

14 } catch (_) { }

16 // 2. Installed as dependency in a user's project

17 try {

18 const nodeModulesPkg = path.join(process.cwd(), 'node_modules', 'emonfca', 'package.json');

19 if (fs.existsSync(nodeModulesPkg)) {

20 const pkg = JSON.parse(fs.readFileSync(nodeModulesPkg, 'utf-8'));

21 if (pkg.version) return pkg.version;

Lines 69-109javascript

69 }

70 } catch (error) {

71 console.log('\x1b[31m%s\x1b[0m', '❌ Failed to check for EMON-FCA updates:', error.message);

72 return false;

73 }

74}

e2eebot.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * ═══════════════════════════════════════════════════════════════════════════════

6 * E2EE Test Bot - EMON-FCA E2EE System (NEW - Proper Implementation)

7 * ═══════════════════════════════════════════════════════════════════════════════

8 *

9 * Uses the new Client class from lib/index.mjs directly

10 * Properly initializes E2EE with device data and memory management

11 */

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code