fca-nx@5.5.5
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic storage of reusable session credentials warrants a warning, but inspected source does not establish malicious behavior. Network and remote-control paths are user-configured or package-aligned.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Application import creates the database directory; a successful login stores session data.
Impact
Other local processes or users able to read the project database could reuse the saved session.
Mechanism
Automatic local persistence of reusable session credentials.
AI rationale
The automatic storage of reusable session credentials warrants a warning, but inspected source does not establish malicious behavior. Network and remote-control paths are user-configured or package-aligned.
Evidence
module/loginHelper.jssrc/database/models/index.jsmodule/config.jssrc/remote/remoteClient.jspackage.jsonFca_DatabaseFca_Database/database.sqlite
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Successful logins automatically store the session app state and cookie header in SQLite.
- The database is created under the consumer project's working directory.
- This persists reusable Facebook session material without a separate user command.
Evidence against
- package.json has no install lifecycle scripts or self-dependency.
- The remote WebSocket feature is disabled by default and requires a configured URL.
- The external credential-login endpoint has no default host and refuses to run unless configured.
- No source evidence of child-process execution, secret exfiltration, or remote payload execution was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcee2ee/vendor/fb-e2ee.cjsView file
2964patternName = google_api_key
severity = high
line = 2964
matchedText = ["64", "...7"],
High
High Secret
Package contains a high-severity secret pattern.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L29642964patternName = google_api_key
severity = high
line = 2964
matchedText = ["64", "...7"],
High
130copyProps(Buffer3, SafeBuffer);
L131: SafeBuffer.from = function(arg, encodingOrOffset, length) {
L132: if (typeof arg === "number") {
...
L400: * @return {Object} Accepted configuration
L401: * @private
L402: */
...
L543: this._inflate[kWriteInProgress] = true;
L544: this._inflate.write(data);
L545: if (fin) this._inflate.write(TRAILER);
...
L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data
L661: * @param {WebSocket} target A reference to the target to which the event was dispatched
L662: */
Low
Weak Crypto
Package source references weak cryptographic algorithms.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L130Findings
9 High3 Medium6 Low
HighHigh Secrete2ee/vendor/fb-e2ee.cjs
HighKnown Malware Source Similaritye2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js
HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js
HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js
HighSecret Patterne2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/vendor/fb-e2ee.cjs
MediumDynamic Requiree2ee/protocol.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to fca-nx@5.5.5.
See all versions of fca-nx for other recorded verdicts.
- Review the evidence and your use of fca-nx@5.5.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.