registry / fca-sahu / 0.0.10

fca-sahu@0.0.10

Lightweight and enhanced unofficial Facebook Chat API client for Messenger automation, real-time MQTT listening, and session-stable chat operations.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 145 file(s), 937 KB of source, external domains: api.facebook.com, business.facebook.com, graph.facebook.com, m.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, web.facebook.com, www.facebook.com, www.messenger.com

Source & flagged code

5 flagged

src/app/updateCheck.jsView file

Lines 1-23javascript

1"use strict";

3const https = require("https");

4const { execSync } = require("child_process");

High

Child Process

Package source references child process execution.

src/app/updateCheck.jsView on unpkg · L3

6/**

7 * Checks npm registry for a newer version of the package.

8 * @param {string} packageName - The npm package name.

9 * @param {string} currentVersion - Current installed version.

10 * @param {object} [options] - Options.

11 * @param {string} [options.registryUrl] - npm registry URL.

12 * @param {number} [options.timeoutMs] - Request timeout in ms.

13 * @returns {Promise<{hasUpdate: boolean, latest: string, current: string}>}

14 */

15async function checkForPackageUpdate(packageName, currentVersion, options = {}) {

16 const registryUrl = options.registryUrl || "https://registry.npmjs.org";

17 const timeoutMs = options.timeoutMs || 10000;

19 return new Promise((resolve) => {

20 const url = `${registryUrl}/${encodeURIComponent(packageName)}/latest`;

21 const timer = setTimeout(() => resolve({ hasUpdate: false, latest: currentVersion, current: currentVersion }), timeoutMs);

23 https.get(url, { headers: { Accept: "application/json" } }, (res) => {

Lines 58-93javascript

58 */

59async function runConfiguredUpdateCheck(config, logger) {

60 const log = typeof logger === "function" ? logger : () =>

index.jsView file

Lines 1-22javascript

1"use strict";

3const { login, loginAsync, loginLegacy, DEFAULT_OPTIONS } = require('./src/engine/client');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

src/utils/auth-helpers.jsView file

Lines 76-116javascript

76 } else {

77 return totpGenerator(cleaned);

78 }

79 } catch (requireError) {

80 const crypto = require('crypto'

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

5 flagged · loading source

src/app/updateCheck.jsView file

fca-sahu@0.0.10

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code