registry / Credential exfiltration / fca-uzair-rajput-developer
fca-uzair-rajput-developer
Uzair Rajput Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically
This report shows the evidence for fca-uzair-rajput-developer@2.0.0. 3 of 6 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete credential exfiltration to a non-Facebook package-controlled default endpoint, not merely Messenger API traffic. No install hook is needed because the harmful path is reachable during the package’s advertised login operation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
User calls login/loginAsync or an automatic re-login fallback runs.
Impact
Facebook credentials, optional 2FA, and returned session material can be exposed to the remote operator; runtime update can replace local dependencies.
Mechanism
Default remote credential submission and runtime self-update installation.
Attack narrative
The entrypoint creates fca-uzair.json with apiServer set to https://minhdong.site. Its loginViaAPI serializes supplied email, password, and optional two-factor code and POSTs them to that host; automatic re-login can invoke this path from configured credentials. The same login flow enables update checks by default and executes npm i for the latest package in process.cwd().
AI rationale
This is concrete credential exfiltration to a non-Facebook package-controlled default endpoint, not merely Messenger API traffic. No install hook is needed because the harmful path is reachable during the package’s advertised login operation.
Evidence
package.jsondist/index.jsfca-uzair.json
Network endpoints2
minhdong.site/api/v1/facebook/login_iosregistry.npmjs.org
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/index.js defaults apiServer to https://minhdong.site.
- loginViaAPI posts email, password, and optional 2FA to /api/v1/facebook/login_ios.
- Auto-login fallback passes configured credentials to that API server.
- loginAsync performs enabled-by-default update check and runs npm i for the latest package.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The package’s normal Messenger API requests target Facebook hosts.
- Remote-control WebSocket requires an explicit enabled config and URL.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
8 flagged · loading sourcedist/index.jsView file
•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay.
dist/index.js:
isVoiceMail: blob.is_voicemail
hasEmailParticipant: data.has_email_participant,
const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ...
"application/vnd.omads-email+xml": {
"application/vnd.seemail": {
autoLogin: true,
credentials: { email: "", password: "", twofactor: "" },
hasEmailParticipant: false,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg36// src/func/logger.ts
L37: function writeStdout(message) {
L38: process.stdout.write(`${message}
L39: `);
...
L55: function getTheme() {
L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase();
L57: if (fromEnv === "minimal") return "minimal";
...
L135: const parts2 = parseLabel(message, "READY");
L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body);
L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label));
...
L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
L1526: const referer = options?.referer ||
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L3615814return new Promise((resolve, reject) => {
L15815: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => {
L15816: if (error) {
High
36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution.
L36: // src/func/logger.ts
L37: function writeStdout(message) {
L38: process.stdout.write(`${message}
L39: `);
...
L55: function getTheme() {
L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase();
L57: if (fromEnv === "minimal") return "minimal";
...
L135: const parts2 = parseLabel(message, "READY");
L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body);
L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label));
...
L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L36•matchType = normalized_sha256
matchedPackage = @cexy/wonfca@1.0.4
matchedPath = dist/index.js
matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = a8243e75e6793089
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @cexy/wonfca@1.0.2
matchedPath = dist/index.js
matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.2
similarity = 1.000
shingleOverlap = 3
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkgdist/index.mjsView file
43Trigger-reachable chain: manifest.exports -> dist/index.mjs
L43: import gradient from "gradient-string";
L44: function writeStdout(message) {
L45: process.stdout.write(`${message}
L46: `);
...
L62: function getTheme() {
L63: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase();
L64: if (fromEnv === "minimal") return "minimal";
...
L142: const parts2 = parseLabel(message, "READY");
L143: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body);
L144: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label));
...
L1530: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.mjsView on unpkg · L43•matchType = normalized_sha256
matchedPackage = @cexy/wonfca@1.0.2
matchedPath = dist/index.mjs
matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.mjsView on unpkgFindings
3 Critical6 High3 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.js
HighShell
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/index.mjs
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to fca-uzair-rajput-developer@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing fca-uzair-rajput-developer@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
6 known versions2.0.0latestshownMaliciousCredential ExfiltrationBlockPublishedAug 9, 2026, 11:10 AM1.2.1MaliciousCredential ExfiltrationBlockPublishedAug 7, 2026, 8:51 AM1.10.1Clean—AllowPublishedJul 18, 2026, 8:18 PM1.10.0SuspiciousRemote Code ExecutionWarnPublishedJul 18, 2026, 7:37 PM1.3.0MaliciousCredential ExfiltrationBlockPublishedJul 14, 2026, 2:14 PM1.2.0Clean—AllowPublishedJul 11, 2026, 11:00 AM