hridoy-fca@4.2.1
Unofficial Facebook Chat API for Node.js with safe inbox mode, GoatBot compatibility and advanced connection management - Enhanced by HRIDOY
AI Security Review
scanned 13d ago · by lpm-firewall-aiStatic inspection found a real but caller-triggered shell-injection risk in the exported update helper. The automatic update path does not invoke it, so the evidence supports a warning rather than a package-wide malicious behavior verdict.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer calls updateNpmPackage(version), especially with a version value influenced by untrusted input.
Impact
Potential command execution in the consumer process context; no automatic invocation of this helper was identified.
Mechanism
The helper interpolates version into an execSync command string that runs npm install through a shell.
AI rationale
Static inspection found a real but caller-triggered shell-injection risk in the exported update helper. The automatic update path does not invoke it, so the evidence supports a warning rather than a package-wide malicious behavior verdict.
Evidence
checkUpdate.js
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package has no install lifecycle hook in its manifest.
- Loading the main module triggers an update check, but the check reports an available version without installing it.
- An exported update helper interpolates its caller-supplied version into a shell command, creating command-injection risk when called with untrusted input.
- The flagged access-token code makes requests to Facebook’s business site as part of its two-factor reauthentication flow.
Evidence against
- The risky install helper is explicitly exported for caller invocation; the automatic update check does not invoke it.
- The inspected access-token flow sends the supplied two-factor code to Facebook and retrieves the resulting token from Facebook.
Behavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcecheckUpdate.jsView file
1const axios = require('axios');
L2: const { execSync } = require('child_process');
L3: const fs = require('fs');
High
85console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install hridoy-fca@${version}...`);
L86: execSync(`npm install hridoy-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' });
L87: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
checkUpdate.jsView on unpkg · L85e2eebot.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
e2eebot.jsView on unpkg · L12Findings
4 High4 Medium5 Low
HighChild ProcesscheckUpdate.js
HighShell
HighRuntime Package InstallcheckUpdate.js
HighKnown Malware Source Similaritysrc/getAccess.js
MediumDynamic Requiree2eebot.js
MediumNetwork
MediumShips Native Binarybuild/messagix.so
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvale2eebot.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hridoy-fca@4.2.1.
See all versions of hridoy-fca for other recorded verdicts.
- Review the evidence and your use of hridoy-fca@4.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.