registry / hridoy-fca / 4.3.3

hridoy-fca@4.3.3

Unofficial Facebook Chat API for Node.js with safe inbox mode, GoatBot compatibility and advanced connection management - Enhanced by HRIDOY

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Source inspection found an import-time version check and an explicitly callable package update helper, but no automatic install lifecycle or evidence of an attack. The flagged access code handles Facebook authentication within Facebook endpoints.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Importing the package entry point triggers a non-blocking update check; the install helper is separately callable.

Impact

No automatic package installation, unrelated credential forwarding, or other attack effect was established from these paths.

Mechanism

The automatic check reads the latest package version and prints an install command. The access module sends its two-factor flow to Facebook business pages.

AI rationale

Evidence

package.jsonindex.jscheckUpdate.jssrc/getAccess.js

Network endpoints3

registry.npmjs.orgraw.githubusercontent.combusiness.facebook.com

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package start script launches the documented library entry point and defines no lifecycle hook.
Loading the entry point checks the package's latest version; the updater requests the npm registry and reports availability.
The updater's install helper is a separate exported function, while the automatic check only reports an install command.
The flagged access module requests Facebook business pages and submits a supplied two-factor code to Facebook.

Evidence against

The updater contains a child-process install command, but source shows it is in a separately callable helper rather than the automatic update check.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 97 file(s), 579 KB of source, external domains: 127.0.0.1, accountscenter.facebook.com, api.findids.net, api.imgbb.com, b-graph.facebook.com, business.facebook.com, facebook.com, github.com, graph.facebook.com, id.traodoisub.com, m.facebook.com, raw.githubusercontent.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, upload.imagekit.io, www.facebook.com, www.messenger.com

Source & flagged code

6 flagged

checkUpdate.jsView file

Lines 1-21javascript

1const axios = require('axios');

2const { execSync } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

4const path = require('path');

6function getCurrentVersion() {

7 // 1. If this file is inside the hridoy-fca package itself (development mode), use its own package.json

8 try {

9 const ownPkg = path.join(__dirname, 'package.json');

10 if (fs.existsSync(ownPkg)) {

11 const pkg = JSON.parse(fs.readFileSync(ownPkg, 'utf-8'));

12 if (pkg.name === 'hridoy-fca' && pkg.version) return pkg.version;

13 }

14 } catch (_) { }

16 // 2. Installed as dependency in a user's project

17 try {

18 const nodeModulesPkg = path.join(process.cwd(), 'node_modules', 'hridoy-fca', 'package.json');

19 if (fs.existsSync(nodeModulesPkg)) {

20 const pkg = JSON.parse(fs.readFileSync(nodeModulesPkg, 'utf-8'));

21 if (pkg.version) return pkg.version;

Lines 65-105javascript

65 }

66 } catch (error) {

67 console.log('\x1b[31m%s\x1b[0m', '❌ Failed to check for HRIDOY-FCA updates:', error.message);

68 return false;

69 }

70}

e2eebot.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * ═══════════════════════════════════════════════════════════════════════════════

6 * E2EE Test Bot - HRIDOY-FCA E2EE System (NEW - Proper Implementation)

7 * ═══════════════════════════════════════════════════════════════════════════════

8 *

9 * Uses the new Client class from lib/index.mjs directly

10 * Properly initializes E2EE with device data and memory management

11 */

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = fca-sahu@0.0.6 matchedPath = src/getAccess.js matchedIdentity = npm:ZmNhLXNhaHU:0.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

Source & flagged code

6 flagged · loading source

checkUpdate.jsView file

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

85console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install hridoy-fca@${version}...`); L86: execSync(`npm install hridoy-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' }); L87: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L85

e2eebot.jsView file

12L13: const fs = require('fs'); L14: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2eebot.jsView on unpkg · L12

Findings

3 High4 Medium5 Low

HighChild ProcesscheckUpdate.js

HighRuntime Package InstallcheckUpdate.js

HighKnown Malware Source Similaritysrc/getAccess.js

MediumDynamic Requiree2eebot.js

MediumNetwork

MediumShips Native Binarybuild/messagix.so

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvale2eebot.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to hridoy-fca@4.3.3.

See all versions of hridoy-fca for other recorded verdicts.

Review the evidence and your use of hridoy-fca@4.3.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 03:25:16.027Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.