fca-sahu@0.0.3

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

A consumer logs in and starts the MQTT message listener; an incoming message contains a photo attachment.

Unconsented disclosure of received Messenger photo attachments or their accessible URLs.

Automatic third-party photo re-upload from inbound-message processing.

The package registers a hidden internal image uploader backed by ImgBB. During normal MQTT message parsing, every received photo attachment is passed to that uploader before the message callback is delivered. The uploader submits the image value to ImgBB with a package-supplied key, creating a third-party copy or causing ImgBB to retrieve the attachment URL. This is automatic listener behavior rather than an explicit upload API call by the consumer.

Source establishes an automatic, concealed third-party transfer of inbound photo attachments during normal chat-listening operation. The absence of install hooks does not mitigate this runtime data-exfiltration path.