registry / fca-uzair-rajput-developer / 1.10.0

fca-uzair-rajput-developer@1.10.0

Uzair Rajput Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At runtime, login performs a package update check against npm. A configuration-controlled option can invoke npm to install a newer configured package into the caller's working directory; no install-time execution occurs.

Static reason

One or more suspicious static signals were detected.

Trigger

Calling `login` or `loginAsync` with update checks enabled; installation additionally requires `checkUpdate.install: true`.

Impact

A user-enabled or sample-configured update may modify project dependencies and execute the installed package's npm lifecycle behavior.

Mechanism

configuration-driven registry fetch and `child_process.execFile` npm install

Rationale

The package is not conclusively malicious, but its login-time updater can install packages through npm when enabled and the shipped example enables that path. Downgrade to warn for this dangerous configuration-driven capability rather than block.

Evidence

dist/index.jsfca-uzair.example.jsonpackage.jsondocs/DOCS.md

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

fca-uzair-rajput-developer@1.10.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code