registry / hridoy-fca / 4.3.8

hridoy-fca@4.3.8

Unofficial Facebook Chat API for Node.js with safe inbox mode, GoatBot compatibility and advanced connection management - Enhanced by HRIDOY

AI Security Review

scanned 11h ago · by lpm-firewall-ai

Importing the package contacts its npm registry endpoint to check for updates. A separate exported helper can install a chosen package version and edit the consumer manifest, but the inspected source does not invoke it automatically.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Importing index.js triggers the update check; calling updateNpmPackage or updateUserPackageJson triggers mutation.

Impact

The import-time request reveals package use to the npm registry; explicit helper use can change the consumer dependency version.

Mechanism

Package-aligned update checking and explicit self-update helpers.

Rationale

The package has concerning update and native-loading capabilities, but no install lifecycle hook or automatic invocation of the mutation helper. The observed network and messaging behavior is package-aligned, so static source inspection does not establish malicious behavior.

Evidence

package.jsonindex.jscheckUpdate.jslib/index.mjse2ee.jsbuild/messagix.sobuild/messagix.dll

Network endpoints1

registry.npmjs.org/hridoy-fca/latest

hridoy-fca@4.3.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code