registry / Credential exfiltration / fcanew-r3nz75
fcanew-r3nz75
Facebook Chat API - Redefine By renz2451 | r3nz75
This report shows the evidence for fcanew-r3nz75@10.1.15. 16 of 16 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiA default external endpoint receives account credentials through automatic recovery paths. This is concrete credential exfiltration behavior, not ordinary authentication to Facebook.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A consumer invokes the Facebook client with credentials in fca-config.json and the existing session is invalid or exhausts retries.
Impact
The operator of the default server can receive account credentials and return session cookies.
Mechanism
Automatic POST of email, password, and optional two-factor secret to a package-selected external endpoint.
Attack narrative
The package reads credentials from the consumer's fca-config.json. Its default configuration enables auto-login and routes login to minhdong.site. On an invalid session, or after MQTT retry failure, it POSTs the email, password, and optional two-factor secret to that external service and accepts returned cookies. The destination can be overridden, but the package-selected default makes the sensitive forwarding active without a separate user choice.
AI rationale
A default external endpoint receives account credentials through automatic recovery paths. This is concrete credential exfiltration behavior, not ordinary authentication to Facebook.
Evidence
module/config.jsmodule/loginHelper.jssrc/api/socket/core/getSeqID.jsfca-config.json
Network endpoints1
minhdong.site/api/v1/facebook/login_ios
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default configuration enables automatic login and selects minhdong.site as the API server.
- The login helper puts the supplied email and password into a request body and POSTs it to that server's login endpoint.
- An invalid Facebook session automatically invokes this credential-forwarding login path.
- The MQTT recovery path also reads configured credentials and forwards them to the configured API server after retries fail.
Evidence against
- There is no npm install lifecycle hook.
- The API server can be overridden through configuration.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flagged · loading sourcee2ee/vendor/fb-e2ee.cjsView file
2964patternName = google_api_key
severity = high
line = 2964
High
High Secret
Package contains a high-severity secret pattern.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L29642964patternName = google_api_key
severity = high
line = 2964
High
130copyProps(Buffer3, SafeBuffer);
L131: SafeBuffer.from = function(arg, encodingOrOffset, length) {
L132: if (typeof arg === "number") {
...
L400: * @return {Object} Accepted configuration
L401: * @private
L402: */
...
L543: this._inflate[kWriteInProgress] = true;
L544: this._inflate.write(data);
L545: if (fin) this._inflate.write(TRAILER);
...
L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data
L661: * @param {WebSocket} target A reference to the target to which the event was dispatched
L662: */
Low
Weak Crypto
Package source references weak cryptographic algorithms.
e2ee/vendor/fb-e2ee.cjsView on unpkg · L130Findings
1 Critical10 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationmodule/config.js
HighHigh Secrete2ee/vendor/fb-e2ee.cjs
HighSemantic Analysis Limitede2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/e2ee/index.js
HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js
HighKnown Malware Source Similaritymodule/config.js
HighKnown Malware Source Similaritysrc/api/socket/core/getSeqID.js
HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js
HighSecret Patterne2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs
HighSecret Patternsrc/api/socket/e2ee/vendor/fb-e2ee.cjs
Affected versions and remediation
This report applies to fcanew-r3nz75@10.1.15.
The versions list below shows the verdict for each recorded version.
- Avoid installing fcanew-r3nz75@10.1.15. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
16 known versions10.1.15latestshownMaliciousCredential ExfiltrationBlockPublishedAug 23, 2026, 3:55 PM10.1.14MaliciousCredential ExfiltrationBlockPublishedAug 23, 2026, 3:49 PM10.1.13MaliciousCredential ExfiltrationBlockPublishedAug 23, 2026, 3:44 PM10.1.12MaliciousCredential ExfiltrationBlockPublishedAug 23, 2026, 3:38 PM