registry / fca-sahu / 0.0.6

fca-sahu@0.0.6

Unofficial Facebook Chat API for Node.js with enhancements by SHAHADAT SAHU

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Listening for Messenger messages automatically forwards received photo URLs to a third-party image-hosting service. This creates an unconsented copy or retrieval path for private attachments.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A consumer logs in and starts the package's MQTT message listener; a received message contains a photo.

Impact

Private Messenger photo attachments and their access URLs are disclosed to a third-party service without a caller request.

Mechanism

Automatic covert upload of received attachment URLs to ImgBB.

Attack narrative

The listener processes each received message, iterates its photo attachments, and invokes a hidden uploader for each attachment URL. That uploader posts the URL to ImgBB and stores the resulting hosted URL on the attachment. The flow is automatic during normal message listening and has no visible opt-in, so received private media is disclosed outside Facebook.

AI rationale

This is concrete runtime data exfiltration, not merely a network-capable chat API: received photo attachment URLs are silently forwarded to ImgBB. The lack of an install hook does not mitigate the automatic disclosure once the advertised listener is used.

Evidence

index.jssrc/listenMqtt.js

Network endpoints1

api.imgbb.com

Decision evidence

public snapshot

fca-sahu@0.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code