registry / hridoy-fca / 4.3.4

hridoy-fca@4.3.4

Unofficial Facebook Chat API for Node.js with safe inbox mode, GoatBot compatibility, E2EE and integrated advanced reliability, inbox, performance, logging and security management.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The inspected package has no install lifecycle hook, and its import-time update check only reports an available update for the user to install. The flagged authentication code uses the Facebook session for the package's Facebook API purpose; the inspected source does not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Importing index.js starts a nonblocking update check; the Facebook authentication flow runs when the caller requests access.

Impact

No automatic package installation or unrelated credential transmission was established from the inspected paths.

Mechanism

The update check compares versions and prints an installation command. The inspected authentication code uses the Facebook business endpoint with the session cookie jar and retrieves the resulting access token.

AI rationale

Network endpoints2

registry.npmjs.orgbusiness.facebook.com

Decision evidence

public snapshot

AI called this Clean at 85.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares no install lifecycle hook; its scripts are start, test, and syntax checking.
Importing index.js triggers a nonblocking update check against the package's npm registry entry.
The update check reports a newer version and instructs the user to run npm install; it does not install it automatically.
getAccess obtains an access token through Facebook business pages using the existing session cookie jar.

Evidence against

checkUpdate.js exposes update helpers, but no automatic call to them was found in the inspected paths.
The source does not show credentials being sent to an unrelated endpoint in the inspected authentication flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

checkUpdate.jsView file

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

85console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install hridoy-fca@${version}...`); L86: execSync(`npm install hridoy-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' }); L87: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L85

e2eebot.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * ═══════════════════════════════════════════════════════════════════════════════

6 * E2EE Test Bot - HRIDOY-FCA E2EE System (NEW - Proper Implementation)

7 * ═══════════════════════════════════════════════════════════════════════════════

8 *

9 * Uses the new Client class from lib/index.mjs directly

10 * Properly initializes E2EE with device data and memory management

11 */

13const fs = require('fs');

14const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2eebot.jsView on unpkg · L12

16// ─────────────────────────────────────────────────────────────────────────────

17// § 1 DYNAMIC IMPORT FOR ESM

18// ─────────────────────────────────────────────────────────────────────────────

19async function importESM(specifier) {

20 const dynamicImport = new Function('specifier', 'return import(specifier)');

21 return dynamicImport(specifier);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2eebot.jsView on unpkg · L19

22}

24// ─────────────────────────────────────────────────────────────────────────────

25// § 1B MESSAGE HANDLER & COMMANDS

26// ─────────────────────────────────────────────────────────────────────────────

27async function handleMessage(client, event) {

28 const PREFIX = '!';

29 const body = (event.body || '').trim();

31 // Only process messages that start with prefix

32 if (!body.startsWith(PREFIX)) {

33 return;

34 }

36 const withoutPrefix = body.slice(PREFIX.length).trim();

37 const args = withoutPrefix.split(/\s+/);

38 const cmd = (args.shift() || '').toLowerCase();

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = maruf-fca@1.2.31 matchedPath = src/getAccess.js matchedIdentity = npm:bWFydWYtZmNh:1.2.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

Source & flagged code

6 flagged · loading source

checkUpdate.jsView file

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L85

e2eebot.jsView file

12L13: const fs = require('fs'); L14: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2eebot.jsView on unpkg · L12

Findings

3 High4 Medium5 Low

HighChild ProcesscheckUpdate.js

HighRuntime Package InstallcheckUpdate.js

HighKnown Malware Source Similaritysrc/getAccess.js

MediumDynamic Requiree2eebot.js

MediumNetwork

MediumShips Native Binarybuild/messagix.so

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvale2eebot.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to hridoy-fca@4.3.4.

See all versions of hridoy-fca for other recorded verdicts.

Review the evidence and your use of hridoy-fca@4.3.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 03:25:04.724Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.