registry / Credential exfiltration / fca-nx / 6.6.7

fca-nx@6.6.7

Facebook Messenger API for Node.js — Fast, Secure, and Feature-Rich

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The source establishes a real credential-forwarding capability to arbitrary configured endpoints, but it is explicitly gated and has no install-time execution. This warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A caller enables E2EE and sets FB_DGW_ENABLE plus one or more FB_DGW_URL environment variables.

Impact

A configured untrusted endpoint can receive account session credentials.

Mechanism

Forwards session cookies to configurable WebSocket endpoints.

AI rationale

Evidence

e2ee/vendor/fb-e2ee.cjs

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with low false-positive risk.

Evidence for warning

The E2EE DGW mode accepts arbitrary nonempty WebSocket endpoints from environment variables and assembles the logged-in account's cookies into a header.
The DGW socket sends that cookie header to every configured endpoint without a host allowlist.

Evidence against

package.json has no install lifecycle hook.
The risky DGW path requires both explicit E2EE activation and explicit environment settings; fixed service calls target Facebook domains.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 150 file(s), 1.71 MB of source, external domains: 127.0.0.1, facebook.com, github.com, graph.facebook.com, m.facebook.com, reg-e2ee.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, www.facebook.com, www.messenger.com, www.whatsapp.com

Source & flagged code

14 flagged

e2ee/vendor/fb-e2ee.cjsView file

Lines 110-150javascript

110var require_safe_buffer = __commonJS({

111 "node_modules/ws/node_modules/safe-buffer/index.js"(exports2, module2) {

112 "use strict";

113 init_cjs_shims();

114 var buffer = require("buffer");

115 var Buffer3 = buffer.Buffer;

116 function copyProps(src, dst) {

117 for (var key in src) {

118 dst[key] = src[key];

119 }

120 }

121 if (Buffer3.from && Buffer3.alloc && Buffer3.allocUnsafe && Buffer3.allocUnsafeSlow) {

122 module2.exports = buffer;

123 } else {

124 copyProps(buffer, exports2);

125 exports2.Buffer = SafeBuffer;

126 }

127 function SafeBuffer(arg, encodingOrOffset, length) {

128 return Buffer3(arg, encodingOrOffset, length);

129 }

130 copyProps(Buffer3, SafeBuffer);

131 SafeBuffer.from = function(arg, encodingOrOffset, length) {

132 if (typeof arg === "number") {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

Low

Weak Crypto

Package source references weak cryptographic algorithms.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

133 throw new TypeError("Argument must not be a number");

134 }

135 return Buffer3(arg, encodingOrOffset, length);

136 };

137 SafeBuffer.alloc = function(size, fill, encoding) {

138 if (typeof size !== "number") {

139 throw new TypeError("Argument must be a number");

140 }

141 var buf = Buffer3(size);

142 if (fill !== void 0) {

143 if (typeof encoding === "string") {

144 buf.fill(fill, encoding);

145 } else {

146 buf.fill(fill);

147 }

148 } else {

149 buf.fill(0);

150 }

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950 "privacy",

2951

e2ee/index.jsView file

Lines 125-165javascript

125(function _polyfillFileGlobal() {

126 try {

127 if (typeof globalThis.File === "undefined") {

128 var b = require("buffer"

e2ee/protocol.jsView file

Lines 1-34javascript

1"use strict";

3/**

4 * Facebook-specific E2EE wire protocol handling.

5 *

6 * Facebook Secret Conversations use Signal Protocol (X3DH + Double Ratchet)

7 * with their own framing on top. This module handles:

8 * - Key bundle upload/download to Facebook's graph endpoint

9 * - Message framing (encode/decode FCANX_E2EE frame format)

10 * - Signed pre-key signatures using HMAC-SHA256 (FB uses Ed25519 in practice;

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.6.0 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.6.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.6.0 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.6.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Source & flagged code

14 flagged · loading source

e2ee/vendor/fb-e2ee.cjsView file

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

2964patternName = google_api_key severity = high line = 2964

High

High Secret

Package contains a high-severity secret pattern.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964

High

Secret Pattern

Google API key in e2ee/vendor/fb-e2ee.cjs

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Findings

1 Critical10 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltratione2ee/vendor/fb-e2ee.cjs

HighHigh Secrete2ee/vendor/fb-e2ee.cjs

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similaritye2ee/index.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js

HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js

HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js

HighSecret Patterne2ee/vendor/fb-e2ee.cjs

HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

HighSecret Patternsrc/api/socket/e2ee/vendor/fb-e2ee.cjs

Affected versions and remediation

This report applies to fca-nx@6.6.7.

See all versions of fca-nx for other recorded verdicts.

Review the evidence and your use of fca-nx@6.6.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 15:03:10.592Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code