Loading npm security reports…

fca-uzair-rajput-developer@2.0.0: Malicious npm security report | LPM Firewall

registry / fca-uzair-rajput-developer / 2.0.0

fca-uzair-rajput-developer@2.0.0

Uzair Rajput Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically

AI Security Review

scanned 6d ago · by lpm-firewall-ai

On authentication, supplied Facebook credentials are transmitted to a package-default third-party host. Login also defaults to installing a newly discovered npm version into the consumer’s current directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User calls login/loginAsync or an automatic re-login fallback runs.

Impact

Facebook credentials, optional 2FA, and returned session material can be exposed to the remote operator; runtime update can replace local dependencies.

Mechanism

Default remote credential submission and runtime self-update installation.

Attack narrative

The entrypoint creates fca-uzair.json with apiServer set to https://minhdong.site. Its loginViaAPI serializes supplied email, password, and optional two-factor code and POSTs them to that host; automatic re-login can invoke this path from configured credentials. The same login flow enables update checks by default and executes npm i for the latest package in process.cwd().

Rationale

This is concrete credential exfiltration to a non-Facebook package-controlled default endpoint, not merely Messenger API traffic. No install hook is needed because the harmful path is reachable during the package’s advertised login operation.

Evidence

package.jsondist/index.jsfca-uzair.json

Network endpoints2

minhdong.site/api/v1/facebook/login_iosregistry.npmjs.org

Source & flagged code

8 flagged · loading source

dist/index.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. dist/index.js: isVoiceMail: blob.is_voicemail hasEmailParticipant: data.has_email_participant, const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ... "application/vnd.omads-email+xml": { "application/vnd.seemail": { autoLogin: true, credentials: { email: "", password: "", twofactor: "" }, hasEmailParticipant: false,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L36

15814return new Promise((resolve, reject) => { L15815: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => { L15816: if (error) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L15814

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.0.4 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a8243e75e6793089 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @cexy/wonfca@1.0.2 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.2 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

43Trigger-reachable chain: manifest.exports -> dist/index.mjs L43: import gradient from "gradient-string"; L44: function writeStdout(message) { L45: process.stdout.write(`${message} L46: `); ... L62: function getTheme() { L63: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L64: if (fromEnv === "minimal") return "minimal"; ... L142: const parts2 = parseLabel(message, "READY"); L143: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L144: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1530: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L43

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.0.2 matchedPath = dist/index.mjs matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

8 flagged

dist/index.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. dist/index.js: isVoiceMail: blob.is_voicemail hasEmailParticipant: data.has_email_participant, const rules2 = [0, { "ac": [1, { "com": _3, "edu": _3, "gov": _3, "mil": _3, "net": _3, "org": _3, "drr": _4, "feedback": _4, "forms": _4 }], "ad": _3, "ae": [1, { "ac": _3, "co": ... "application/vnd.omads-email+xml": { "application/vnd.seemail": { autoLogin: true, credentials: { email: "", password: "", twofactor: "" }, hasEmailParticipant: false,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L36

15814return new Promise((resolve, reject) => { L15815: (0, import_node_child_process.execFile)(npmCommand, ["i", dependency], { cwd: process.cwd() }, (error, _stdout, stderr) => { L15816: if (error) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L15814

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.0.4 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a8243e75e6793089 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @cexy/wonfca@1.0.2 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.2 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

43Trigger-reachable chain: manifest.exports -> dist/index.mjs L43: import gradient from "gradient-string"; L44: function writeStdout(message) { L45: process.stdout.write(`${message} L46: `); ... L62: function getTheme() { L63: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L64: if (fromEnv === "minimal") return "minimal"; ... L142: const parts2 = parseLabel(message, "READY"); L143: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L144: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1530: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L43

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.0.2 matchedPath = dist/index.mjs matchedIdentity = npm:QGNleHkvd29uZmNh:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg