registry / hridoy-fca / 4.3.7
hridoy-fca@4.3.7
Unofficial Facebook Chat API for Node.js with safe inbox mode, GoatBot compatibility and advanced connection management - Enhanced by HRIDOY
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection found an automatic, package-aligned version check that reports an update but does not install it; the npm installer is a separate exported action. The inspected token flow sends the supplied code and session jar to Facebook, consistent with this Facebook chat API package.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Loading the main entrypoint starts the update check; calling the exported update function triggers installation.
Impact
No confirmed automatic project mutation or unrelated credential exfiltration was established.
Mechanism
The automatic check fetches the hridoy-fca latest version and displays an npm install command. The explicit updater runs npm install in the current working directory.
AI rationale
Source inspection found an automatic, package-aligned version check that reports an update but does not install it; the npm installer is a separate exported action. The inspected token flow sends the supplied code and session jar to Facebook, consistent with this Facebook chat API package.
Evidence
package.jsonindex.jscheckUpdate.jssrc/getAccess.js
Network endpoints2
registry.npmjs.orgbusiness.facebook.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entrypoint is index.js.
- Loading the entrypoint starts a non-blocking update check; the check queries only the hridoy-fca registry package.
- The update check prints an install command and returns without changing the project; the separate install function is explicitly callable.
- getAccess sends the supplied authentication code and session jar to Facebook's two-factor endpoint.
Evidence against
- The package exports a function that runs npm install in the current project when explicitly called.
- The inspected getAccess flow uses Facebook endpoints for authentication and token retrieval.
Behavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcecheckUpdate.jsView file
1const axios = require('axios');
L2: const { execSync } = require('child_process');
L3: const fs = require('fs');
High
85console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install hridoy-fca@${version}...`);
L86: execSync(`npm install hridoy-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' });
L87: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
checkUpdate.jsView on unpkg · L85e2eebot.jsView file
12L13: const fs = require('fs');
L14: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
e2eebot.jsView on unpkg · L12Findings
3 High4 Medium5 Low
HighChild ProcesscheckUpdate.js
HighRuntime Package InstallcheckUpdate.js
HighKnown Malware Source Similaritysrc/getAccess.js
MediumDynamic Requiree2eebot.js
MediumNetwork
MediumShips Native Binarybuild/messagix.so
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvale2eebot.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hridoy-fca@4.3.7.
See all versions of hridoy-fca for other recorded verdicts.
- Review the evidence and your use of hridoy-fca@4.3.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.