registry / fca-nx / 6.0.0

fca-nx@6.0.0

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 150 file(s), 1.71 MB of source, external domains: 127.0.0.1, facebook.com, github.com, graph.facebook.com, m.facebook.com, reg-e2ee.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, www.facebook.com, www.messenger.com, www.whatsapp.com

Source & flagged code

12 flagged

e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in e2ee/vendor/fb-e2ee.cjs

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.9 matchedPath = e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

e2ee/index.jsView on unpkg

145try { L146: var dynamicImport = new Function("specifier", "return import(specifier)"); L147: mod = await dynamicImport(_NATIVE_LIB_URL);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2ee/index.jsView on unpkg · L145

e2ee/protocol.jsView file

14L15: const crypto = require("crypto"); L16: const { hmacSha256, generateKeyPair, randomBytes } = require("./crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2ee/protocol.jsView on unpkg · L14

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.9 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.9 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.9 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Source & flagged code

12 flagged · loading source

e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in e2ee/vendor/fb-e2ee.cjs

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Low

Weak Crypto

Package source references weak cryptographic algorithms.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

Findings

9 High3 Medium6 Low

HighHigh Secrete2ee/vendor/fb-e2ee.cjs

HighKnown Malware Source Similaritye2ee/index.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js

HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js

HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js

HighSecret Patterne2ee/vendor/fb-e2ee.cjs

HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

HighSecret Patternsrc/api/socket/e2ee/vendor/fb-e2ee.cjs

MediumDynamic Requiree2ee/protocol.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to fca-nx@6.0.0.

See all versions of fca-nx for other recorded verdicts.

Review the evidence and your use of fca-nx@6.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-30 02:44:51.641Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.