Loading npm security reports…

fca-raihan: Malicious npm security report (Block) | LPM Firewall

registry / fca-raihan / 37.2.7

fca-raihan@37.2.7

FCA Raihan - Facebook Chat API compatibility build with stable MQTT theme and nickname methods

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Facebook password login forwards email, password, and any configured Base32 two-factor seed to https://minhdong.site/api/v1/facebook/login_ios by default. The relay is documented, but callers need not explicitly select that recipient; no malicious use was established.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Calling the exported login function with credentials when no supplied or restored session is available, or entering credential-based session recovery.

Impact

The external server receives Facebook credentials and potentially a reusable two-factor seed. Compromise or misuse of that server could enable account access; no such misuse was observed.

Mechanism

makeLogin and recovery helpers route credentials through tokens and tokensViaAPI to loginViaAPI. Axios posts the credential body to the configured external server. autoLogin=false does not gate initial makeLogin.

AI rationale

Independent inspection confirms default credential forwarding without mandatory recipient selection, including initial login despite autoLogin=false. The documented relay and its functional use of returned authentication cookies make a legitimate explanation credible and malware intent unproven. The concrete credential exposure warrants a warning, while the medium false-positive risk does not support publishing a block. Administrative decision: User-approved administrative block for this exact version: default Facebook password login exports email, password, and any configured reusable TOTP seed to minhdong.site without mandatory recipient selection. The documentation discloses the relay; malicious intent or subsequent misuse is not established. The automated follow-up recommends a warning, and this administrative block is a separate protective decision.

Evidence

index.jsmodule/login.jsmodule/config.jsmodule/loginHelper.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

index.js exports the login function from module/login.js. That function passes caller-supplied Facebook email and password to loginHelper.
Without supplied AppState, Cookie, or a restored database session, loginHelper invokes makeLogin. makeLogin uses caller-supplied or configured credentials, includes credentials.twofactor, and calls tokens without checking autoLogin. Setting autoLogin=false therefore does not prevent initial password forwarding.
module/config.js defaults autoLogin to true and apiServer to https://minhdong.site. Credentials default to empty strings. Configuration can override the server, but initial password login does not require callers to select a recipient or separately approve credential forwarding.
The tokens helpers reach loginViaAPI, which selects apiBaseUrl, config.apiServer, or https://minhdong.site without a destination allowlist. It builds an email/password body, adds the configured two-factor seed after whitespace removal and uppercasing, and sends an Axios POST to /api/v1/facebook/login_ios.
During login-time session recovery, tryAutoLoginIfNeeded attempts existing and database-backed sessions before using configured credentials. This helper rejects external recovery when autoLogin is false or the string false; the initial makeLogin path has no equivalent gate.
DOCS.md section 1.4 and the configuration table disclose the external login API and its default https://minhdong.site destination. They identify credentials.twofactor as a reusable Base32 TOTP secret rather than a six-digit code. This supports a documented login-relay interpretation, while leaving the default credential exposure intact.

Evidence against

The external API response supplies cookies and authentication information that the implementation uses to establish a Facebook session. Static inspection does not establish subsequent misuse or malicious intent.
The documentation discloses the external server, so total concealment is not supported. However, disclosure alone does not establish that every password-login caller approved that recipient.
No npm install lifecycle hook or runtime self-dependency is declared. Usable supplied or restored sessions can avoid the initial password relay.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 204 file(s), 1.69 MB of source, external domains: 127.0.0.1, accountscenter.facebook.com, b-graph.facebook.com, facebook.com, github.com, m.facebook.com, minhdong.site, reg-e2ee.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, www.facebook.com, www.messenger.com, www.whatsapp.com

Source & flagged code

19 flagged · loading source

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964

High

Secret Pattern

Google API key in src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

src/api/socket/e2ee/e2ee/nativeBridge.jsView file

•matchType = normalized_sha256 matchedPackage = fca-riyad@37.2.7 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLXJpeWFk:37.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/nativeBridge.jsView on unpkg

37function getDynamicImport() { L38: if (!_dynamicImport) _dynamicImport = new Function("specifier", "return import(specifier);"); L39: return _dynamicImport;

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/e2ee/nativeBridge.jsView on unpkg · L37

module/loginHelper.jsView file

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoáº·c sá»‘ Ä‘iá»‡n thoáº¡i * @param {string} password - Máºt kháº©u * @param {string|null} twoFactor - Secret Base32 cho 2FA (khÃ´ng pháº£i mÃ£ 6 sá»‘) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = conf

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.5 matchedPath = module/config.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/socket/e2ee/nativeBridge.jsView file

•matchType = normalized_sha256 matchedPackage = fca-riyad@37.2.7 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLXJpeWFk:37.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/nativeBridge.jsView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.15 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.15 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.5 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.15 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.5 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Source & flagged code

19 flagged

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

Lines 110-150javascript

110var require_safe_buffer = __commonJS({

111 "node_modules/ws/node_modules/safe-buffer/index.js"(exports2, module2) {

112 "use strict";

113 init_cjs_shims();

114 var buffer = require("buffer");

115 var Buffer3 = buffer.Buffer;

116 function copyProps(src, dst) {

117 for (var key in src) {

118 dst[key] = src[key];

119 }

120 }

121 if (Buffer3.from && Buffer3.alloc && Buffer3.allocUnsafe && Buffer3.allocUnsafeSlow) {

122 module2.exports = buffer;

123 } else {

124 copyProps(buffer, exports2);

125 exports2.Buffer = SafeBuffer;

126 }

127 function SafeBuffer(arg, encodingOrOffset, length) {

128 return Buffer3(arg, encodingOrOffset, length);

129 }

130 copyProps(Buffer3, SafeBuffer);

131 SafeBuffer.from = function(arg, encodingOrOffset, length) {

132 if (typeof arg === "number") {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

133 throw new TypeError("Argument must not be a number");

134 }

135 return Buffer3(arg, encodingOrOffset, length);

136 };

137 SafeBuffer.alloc = function(size, fill, encoding) {

138 if (typeof size !== "number") {

139 throw new TypeError("Argument must be a number");

140 }

141 var buf = Buffer3(size);

142 if (fill !== void 0) {

143 if (typeof encoding === "string") {

144 buf.fill(fill, encoding);

145 } else {

146 buf.fill(fill);

147 }

148 } else {

149 buf.fill(0);

150 }

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950 "privacy",

2951

src/api/socket/e2ee/e2ee/nativeBridge.jsView file

Lines 17-57javascript

17 * binary requires mediaKey/directPath, there's no plain CDN URL for

18 * E2EE media) and served over a local loopback HTTP URL, because

19 * riyad-bot's commands generally expect attachment.url to be a normal

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoáº·c sá»‘ Ä‘iá»‡n thoáº¡i * @param {string} password - Máºt kháº©u * @param {string|null} twoFactor - Secret Base32 cho 2FA (khÃ´ng pháº£i mÃ£ 6 sá»‘) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = conf

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.5 matchedPath = module/config.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/socket/e2ee/nativeBridge.jsView file

•matchType = normalized_sha256 matchedPackage = fca-riyad@37.2.7 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLXJpeWFk:37.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/nativeBridge.jsView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.15 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.15 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.5 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.15 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.5 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950