fca-nx@1.9.0
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection found no lifecycle execution, credential harvesting, exfiltration endpoint, payload execution, or destructive behavior. Static signals stem from Messenger/E2EE functionality and vendored protocol code; the optional remote channel is off by default and only emits received events.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Caller invokes login/E2EE APIs or explicitly enables remoteControl in fca-config.json.
Impact
Expected Messenger session and messaging operations; no unconsented install-time behavior found.
Mechanism
Facebook Messenger API client with optional operator-configured WebSocket events.
AI rationale
Source inspection found no lifecycle execution, credential harvesting, exfiltration endpoint, payload execution, or destructive behavior. Static signals stem from Messenger/E2EE functionality and vendored protocol code; the optional remote channel is off by default and only emits received events.
Evidence
package.jsonmodule/config.jsmodule/loginHelper.jssrc/remote/remoteClient.jssrc/api/socket/e2ee/store.jsfca-config.jsonfcanx_e2ee_<userID>.json
Network endpoints1
www.facebook.com/
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No install lifecycle hook is declared.
- Remote control is disabled by default and requires operator configuration.
- Configured remote messages are emitted as events; no command execution is present.
Evidence against
- Entrypoint exposes a Messenger login API and performs user-invoked Facebook networking.
- E2EE code persists local encrypted session material when its API is used.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcee2ee/vendor/fb-e2ee.cjsView file
2964patternName = google_api_key
severity = high
line = 2964
matchedText = ["64", "...7"],
High
High Secret
Package contains a high-severity secret pattern.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L29642964patternName = google_api_key
severity = high
line = 2964
matchedText = ["64", "...7"],
High
130copyProps(Buffer3, SafeBuffer);
L131: SafeBuffer.from = function(arg, encodingOrOffset, length) {
L132: if (typeof arg === "number") {
...
L400: * @return {Object} Accepted configuration
L401: * @private
L402: */
...
L543: this._inflate[kWriteInProgress] = true;
L544: this._inflate.write(data);
L545: if (fin) this._inflate.write(TRAILER);
...
L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data
L661: * @param {WebSocket} target A reference to the target to which the event was dispatched
L662: */
Low
Weak Crypto
Package source references weak cryptographic algorithms.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L130Findings
9 High3 Medium6 Low
HighHigh Secrete2ee/vendor/fb-e2ee.cjs
HighKnown Malware Source Similaritye2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js
HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js
HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js
HighSecret Patterne2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/vendor/fb-e2ee.cjs
MediumDynamic Requiree2ee/protocol.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to fca-nx@1.9.0.
See all versions of fca-nx for other recorded verdicts.
- Review the evidence and your use of fca-nx@1.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.