Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

fca-sahu@0.0.2: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / fca-sahu / 0.0.2

fca-sahu@0.0.2

Unofficial Facebook Chat API for Node.js with enhancements by SHAHADAT SAHU

AI Security Review

scanned 1d ago · by lpm-firewall-ai

When E2EE is enabled and connected, the package loads an opaque native library with Facebook session cookies. No source-confirmed third-party exfiltration or install-time execution was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer enables E2EE and calls connectE2EE.

Impact

Unverifiable native code could access authenticated Messenger session data.

Mechanism

Native E2EE client loading with authenticated cookies.

Rationale

No concrete malicious chain is proven, but an opaque native component receives high-value session cookies and performs networked messaging operations. This is an unresolved dangerous capability warranting a warning.

Evidence

package.jsonindex.jse2ee.jslib/index.mjsbuild/messagix.so

Network endpoints1

b-graph.facebook.com/graphql

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Loads bundled native binary through koffi.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

E2EE bridge passes Facebook session cookies to native client.

Native binary is opaque and has broad messaging/E2EE capability.

Evidence against

No preinstall, install, or postinstall hook.
Main entry exports a login function; it does not auto-run.
Reviewed JS network calls are Facebook or user-configured image hosts; no confirmed exfiltration endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 95 file(s), 556 KB of source, external domains: 127.0.0.1, accountscenter.facebook.com, api.findids.net, b-graph.facebook.com, business.facebook.com, facebook.com, github.com, graph.facebook.com, id.traodoisub.com, m.facebook.com, static.xx.fbcdn.net, upload.facebook.com, upload.imagekit.io, www.facebook.com, www.messenger.com

Source & flagged code

5 flagged · loading source

e2eebot.jsView file

3L4: const fs = require("fs"); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2eebot.jsView on unpkg · L3

8async function importESM(specifier) { L9: const dynamicImport = new Function("specifier", "return import(specifier)"); L10: return dynamicImport(specifier);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2eebot.jsView on unpkg · L8

index.jsView file

343package = fca-sahu; repositoryIdentity = sahu-fca; dependency = axios L343: try { L344: const axios = require('axios'); L345: const FormData = require('form-data');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L343

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

lib/index.mjsView file

21function libPath() { const base = path.join(resolveDirname(), "..", "build"); if (process.platform === "win32") return path.join(base, "messagix.dll"); if (process.platform === "darwin") return path.join(base, "messagix.dylib"); return path.join(base, "messagix.so"); } __name(libPath, "libPath"); var LIB_FILE = libPath(); if (!fs.existsSync(LIB_FILE)) { throw new Error(`Native library not found at ${LIB_FILE}. Run: npm run build:go`); } var lib = koffi.load(LIB_FILE);

Medium

Ai Review Evidence

Loads bundled native binary through koffi.

lib/index.mjsView on unpkg · L21

Findings

1 High6 Medium5 Low

HighCopied Package Dependency Bridgeindex.js

MediumDynamic Requiree2eebot.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybuild/messagix.so

MediumStructural Risk Force Deep Review

MediumAi Review Evidencelib/index.mjs

LowScripts Present

LowEvale2eebot.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

84%Warn

Verdict confidence

IntentDangerous Capability

TypeUnknown

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorSHAHADAT SAHU

Maintainerssahu-uhas

Version0.0.5

PublishedAug 14, 2026

LicenseMIT

Dependencies17

Integrityverified

Package size10.9 MB

Files100

Keywordsfacebookfacebook-apichatchat-apimessengermessenger-apibotchatbot

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact32.3 MB · 100 files1 signature(s)

Install lifecycleNo install hooks · other: start, test

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocketHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

e2eebot.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2"use strict";

3

4const fs = require("fs");

5

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2eebot.jsView on unpkg · L3

6const path = require("path");

7

8async function importESM(specifier) {

9 const dynamicImport = new Function("specifier", "return import(specifier)");

10 return dynamicImport(specifier);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2eebot.jsView on unpkg · L8

11}

12

13async function handleMessage(client, event) {

14 const PREFIX = "!";

15 const body = (event.body || "").trim();

16 if (!body.startsWith(PREFIX)) {

17 return;

18 }

19 const withoutPrefix = body.slice(PREFIX.length).trim();

20 const args = withoutPrefix.split(/\s+/);

21 const cmd = (args.shift() || "").toLowerCase();

22 console.log(`\n🎯 [command] /${cmd}`);

23 console.log(` Args: ${JSON.stringify(args)}`);

24 console.log(` From: ${event.senderID}`);

25 console.log(` Thread: ${event.threadID}\n`);

26 try {

27 switch (cmd) {

28 case "ping":

index.jsView file

Lines 323-363javascript

323 url: 'https://api.imgbb.com/1/upload',

324 qs: { expiration, key: _imgKeys.imgbb },

325 formData,

326 },

327 function (error, response, body) {

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

lib/index.mjsView file

Lines 1-41javascript

1var __defProp = Object.defineProperty;

2var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

3

4// src/client.ts

5

328

if (error) return reject(error);

329 try {

330 const data = JSON.parse(body);

331 if (!data || !data.success) return reject(data || new Error('ImgBB upload failed'));

332 resolve(data);

333 } catch (err) {

334 reject(err);

335 }

336 }

337 );

338 });

339 }

340

341 async function _uploadToImageKit(image) {

342 if (!_imgKeys.ik_pub || !_imgKeys.ik_priv) return null;

343 try {

344 const axios = require('axios');

345 const FormData = require('form-data');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L343

346 const form = new FormData();

347 let fileValue;

348 if (Buffer.isBuffer(image)) {

349 fileValue = image.toString('base64');

350 } else if (typeof image === 'string') {

351 fileValue = image;

352 } else {

353 return null;

354 }

355 form.append('file', fileValue);

356 form.append('fileName', 'sahu-fca_' + Date.now() + '.jpg');

357 form.append('publicKey', _imgKeys.ik_pub);

358 const auth = Buffer.from(_imgKeys.ik_priv + ':').toString('base64');

359 const res = await axios.post('https://upload.imagekit.io/api/v1/files/upload', form, {

360 headers: Object.assign({ 'Authorization': 'Basic ' + auth }, form.getHeaders())

361 });

362 if (res.data && res.data.url) return res.data.url;

363 } catch (_) { }

import

{ EventEmitter }

from

"events"

;

6

7// src/native.ts

8import fs from "fs";

9import path from "path";

10import { fileURLToPath } from "url";

11import koffi from "koffi";

12import JSONBig from "yumi-json-bigint";

13var JSONBigNative = JSONBig({

14 useNativeBigInt: true,

15 parseAsBigInt32: true

16});

17function resolveDirname() {

18 return path.dirname(fileURLToPath(import.meta.url));

19}

20__name(resolveDirname, "resolveDirname");

21function libPath() {

22 const base = path.join(resolveDirname(), "..", "build");

23 if (process.platform === "win32") return path.join(base, "messagix.dll");

24 if (process.platform === "darwin") return path.join(base, "messagix.dylib");

25 return path.join(base, "messagix.so");

26}

27__name(libPath, "libPath");

28var LIB_FILE = libPath();

29if (!fs.existsSync(LIB_FILE)) {

30 throw new Error(`Native library not found at ${LIB_FILE}. Run: npm run build:go`);

31}

32var lib = koffi.load(LIB_FILE);

Medium

Ai Review Evidence

Loads bundled native binary through koffi.

lib/index.mjsView on unpkg · L21

33var mk = /* @__PURE__ */ __name((ret, name, args) => lib.func(name, ret, args), "mk");

34var fns = {

35 MxFreeCString: mk("void", "MxFreeCString", ["char*"]),

36 MxNewClient: mk("str", "MxNewClient", ["str"]),

37 MxConnect: mk("str", "MxConnect", ["str"]),

38 MxConnectE2EE: mk("str", "MxConnectE2EE", ["str"]),

39 MxDisconnect: mk("str", "MxDisconnect", ["str"]),

40 MxIsConnected: mk("str", "MxIsConnected", ["str"]),

41 MxSendMessage: mk("str", "MxSendMessage", ["str"]),