registry / fca-nx / 1.8.5

fca-nx@1.8.5

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The static hints correspond to a Messenger API with bundled E2EE code, not a concrete malicious chain. No install-time execution or unconsented exfiltration/control-surface mutation was found.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User calls login(); E2EE auto-connect follows successful login.

Impact

Creates project-local E2EE state and connects to Meta Messenger services for requested API functionality.

Mechanism

Messenger session and E2EE client initialization

AI rationale

The static hints correspond to a Messenger API with bundled E2EE code, not a concrete malicious chain. No install-time execution or unconsented exfiltration/control-surface mutation was found.

Evidence

package.jsonmodule/loginHelper.jsmodule/config.jssrc/remote/remoteClient.jssrc/api/socket/e2ee/index.jse2ee/index.js.fca-nx/e2ee_device.json

Network endpoints2

www.facebook.comwss://web-chat-e2ee.facebook.com/ws/chat

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

After successful login, runtime auto-connects an E2EE client using the logged-in session.
The E2EE feature writes its device store under the calling project's .fca-nx directory.

Evidence against

package.json has no preinstall, install, postinstall, or other lifecycle hook.
All observed fixed service endpoints are Facebook/Meta Messenger endpoints aligned with the package purpose.
Remote WebSocket support is disabled by default and requires an operator-supplied URL.
Dynamic loading only targets a package-relative missing lib/index.mjs fallback; no payload is present.
No credential harvesting, third-party exfiltration, shell execution, or AI-agent configuration writes were found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

12 flagged

e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in e2ee/vendor/fb-e2ee.cjs

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.4.0 matchedPath = e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

e2ee/index.jsView on unpkg

145try { L146: var dynamicImport = new Function("specifier", "return import(specifier)"); L147: mod = await dynamicImport(_NATIVE_LIB_URL);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2ee/index.jsView on unpkg · L145

e2ee/protocol.jsView file

14L15: const crypto = require("crypto"); L16: const { hmacSha256, generateKeyPair, randomBytes } = require("./crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2ee/protocol.jsView on unpkg · L14

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.4.0 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.4.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.4.0 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.4 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Source & flagged code

12 flagged · loading source

e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in e2ee/vendor/fb-e2ee.cjs

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Low

Weak Crypto

Package source references weak cryptographic algorithms.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

Findings

9 High3 Medium6 Low

HighHigh Secrete2ee/vendor/fb-e2ee.cjs

HighKnown Malware Source Similaritye2ee/index.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js

HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js

HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js

HighSecret Patterne2ee/vendor/fb-e2ee.cjs

HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

HighSecret Patternsrc/api/socket/e2ee/vendor/fb-e2ee.cjs

MediumDynamic Requiree2ee/protocol.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to fca-nx@1.8.5.

See all versions of fca-nx for other recorded verdicts.

Review the evidence and your use of fca-nx@1.8.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-22 06:36:33.201Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.