registry / Credential exfiltration / hridoy-fca

hridoy-fca

Facebook Chat API by Hridoy | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free

This report shows the evidence for hridoy-fca@4.3.9. 1 of 17 known versions is blocked or flagged. The newest version, 4.4.0, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package sends Facebook credentials to an unaffiliated default endpoint during its ordinary password-login flow. This is concrete credential exfiltration, not a scanner-only signal.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The consumer calls login with email and password while not supplying a reusable Facebook session.

Impact

The third party can collect account passwords and optional two-factor secrets, then return account session material.

Mechanism

Posts supplied Facebook credentials to a third-party login API.

Attack narrative

The exported login function passes user-supplied credentials into the login helper. If the caller has not supplied app-state cookies, the helper uses its password-login path, which builds a request body containing the email and password and sends it to the default minhdong.site endpoint. The configuration selects that host by default. This creates a concrete credential-exfiltration path during ordinary runtime use, despite the absence of lifecycle scripts.

AI rationale

The package sends Facebook credentials to an unaffiliated default endpoint during its ordinary password-login flow. This is concrete credential exfiltration, not a scanner-only signal.

Evidence

module/login.jsmodule/loginHelper.jsmodule/config.jsfca-config.json

Network endpoints1

minhdong.site/api/v1/facebook/login_ios

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The public login entry forwards caller-supplied email and password into the login helper.
When no app state or cookie is supplied, the helper automatically invokes the credential login path.
That path posts the email and password to a package-selected third-party host, minhdong.site, rather than Facebook.
The third-party host is the default configuration value, so callers need not select it themselves.

Evidence against

The manifest has no install or lifecycle hooks.
Auto-relogin from the project config is disabled by default.
The WebSocket remote-control feature requires an enabled configuration and URL.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

10 flagged

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

80// eslint-disable-next-line no-new-func L81: return new Function("s", "return import(s)")(specifier); L82: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/native/nativeMediaBridge.jsView on unpkg · L80

module/loginHelper.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.3 matchedPath = module/loginHelper.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.9 matchedPath = [redacted].js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

module/config.jsView file

•matchType = normalized_sha256 matchedPackage = fcanew-r3nz75@10.1.9 matchedPath = module/config.js matchedIdentity = npm:ZmNhbmV3LXIzbno3NQ:10.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.3 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.0.3 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

Source & flagged code

10 flagged · loading source

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

303patternName = google_api_key severity = high line = 303 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

80// eslint-disable-next-line no-new-func L81: return new Function("s", "return import(s)")(specifier); L82: }

Low

Findings

7 High6 Medium5 Low

HighHigh Secretsrc/api/socket/e2ee/vendor/fme/dist/index.cjs

HighKnown Malware Source Similaritymodule/loginHelper.js

HighKnown Malware Source Similaritysrc/api/messaging/uploadAttachment.js

HighKnown Malware Source Similaritymodule/config.js

HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js

HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js

HighSecret Patternsrc/api/socket/e2ee/vendor/fme/dist/index.cjs

MediumDynamic Requiremodule/loginHelper.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarysrc/api/socket/e2ee/native/build/messagix.so

Medium

Affected versions and remediation

This report applies to hridoy-fca@4.3.9.

The versions list below shows the verdict for each recorded version.

Avoid installing hridoy-fca@4.3.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-28 18:36:27.188Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

17 known versions

4.4.0latestSuspicious—WarnPublishedAug 31, 2026, 6:26 PM 4.3.9shownMaliciousCredential ExfiltrationBlockPublishedAug 28, 2026, 6:14 PM 4.3.8Clean—AllowPublishedAug 28, 2026, 1:16 PM 4.3.7Clean—AllowPublishedAug 27, 2026, 7:13 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code