fca-nx@1.9.5
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe flagged primitives are configuration-gated features of a Messenger client, not automatic package-install behavior. Source inspection found no lifecycle hook, self-dependency chain, shell execution, or unconsented data transfer.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The consumer must call login and explicitly configure an external API or remote-control URL.
Impact
No unconsented install-time execution, persistence, or exfiltration is established.
Mechanism
Messenger login, messaging, and optional configured network clients.
AI rationale
The flagged primitives are configuration-gated features of a Messenger client, not automatic package-install behavior. Source inspection found no lifecycle hook, self-dependency chain, shell execution, or unconsented data transfer.
Evidence
package.jsonmodule/config.jsmodule/loginHelper.jssrc/remote/remoteClient.jse2ee/index.js
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- A legacy E2EE fallback dynamically imports a local module path that is not present in this package.
- The login helper can transmit supplied credentials to an operator-configured external API server.
Evidence against
- package.json has no install lifecycle hook or self-dependency.
- The external API has no default endpoint and rejects use unless the operator configures one.
- Remote WebSocket control is disabled by default and requires a configured URL.
- No package source uses child-process execution, shell commands, or remote payload download.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcee2ee/vendor/fb-e2ee.cjsView file
2964patternName = google_api_key
severity = high
line = 2964
matchedText = ["64", "...7"],
High
High Secret
Package contains a high-severity secret pattern.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L29642964patternName = google_api_key
severity = high
line = 2964
matchedText = ["64", "...7"],
High
130copyProps(Buffer3, SafeBuffer);
L131: SafeBuffer.from = function(arg, encodingOrOffset, length) {
L132: if (typeof arg === "number") {
...
L400: * @return {Object} Accepted configuration
L401: * @private
L402: */
...
L543: this._inflate[kWriteInProgress] = true;
L544: this._inflate.write(data);
L545: if (fin) this._inflate.write(TRAILER);
...
L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data
L661: * @param {WebSocket} target A reference to the target to which the event was dispatched
L662: */
Low
Weak Crypto
Package source references weak cryptographic algorithms.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L130Findings
9 High3 Medium6 Low
HighHigh Secrete2ee/vendor/fb-e2ee.cjs
HighKnown Malware Source Similaritye2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js
HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js
HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js
HighSecret Patterne2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/vendor/fb-e2ee.cjs
MediumDynamic Requiree2ee/protocol.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to fca-nx@1.9.5.
See all versions of fca-nx for other recorded verdicts.
- Review the evidence and your use of fca-nx@1.9.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.