hridoy-ultimate@8.0.2

⚠ Under review

HR ID OY— Node.js Messenger API with guarded MQTT lifecycle and explicit reaction acknowledgements.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 111 file(s), 623 KB of source, external domains: 127.0.0.1, accountscenter.facebook.com, api.findids.net, b-graph.facebook.com, business.facebook.com, facebook.com, github.com, graph.facebook.com, id.traodoisub.com, messenger.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, www.facebook.com, www.messenger.com

Source & flagged code

8 flagged

scripts/check.jsView file

Lines 1-23javascript

1"use strict";

2// Syntax-checks every .js file and verifies relative require() targets exist

3// and that every external require() is declared in package.json.

4const fs = require("fs"), path = require("path"), { spawnSync } = require("child_process");

5const root = path.resolve(__dirname, "..");

High

Child Process

Package source references child process execution.

scripts/check.jsView on unpkg · L3

6const skip = new Set(["node_modules", ".git"]);

7function walk(d) {

8 return fs.readdirSync(d, { withFileTypes: true }).flatMap(e =>

9 skip.has(e.name) ? [] : e.isDirectory() ? walk(path.join(d, e.name)) : [path.join(d, e.name)]);

10}

11const files = walk(root).filter(f => /\.(js|mjs)$/.test(f));

12const pkg = require("../package.json");

13const declared = new Set(Object.keys(pkg.dependencies || {}));

14const builtins = new Set(require("module").builtinModules);

15let bad = 0;

16for (const f of files) {

17 const rel = path.relative(root, f);

18 const r = spawnSync(process.execPath, ["--check", f], { encoding: "utf8" });

19 if (r.status !== 0) { bad++; console.error("SYNTAX " + rel + "\n" + r.stderr); continue; }

20 const src = fs.readFileSync(f, "utf8");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/check.jsView on unpkg · L2

21 const re = /\brequire$\s*(['"])([^'"\n]+)\1\s*$/g; let m;

22 while ((m = re.exec(src))) {

23 const id = m[2];

e2ee.jsView file

Lines 114-154javascript

114 });

115}

116

117async function storeMedia(buffer, mimeType) {

118 var port = await _startMediaServer();

119

checkUpdate.jsView file

Lines 1-24javascript

1"use strict";

3// v1.2.4: read from package.json so the notice can never drift from the real version.

4const CURRENT_VERSION = (function () {

5 try { return require("./package.json").version; } catch (_) {

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = fca-sahu@0.0.6 matchedPath = src/getAccess.js matchedIdentity = npm:ZmNhLXNhaHU:0.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hridoy-ultimate@1.0.0 matchedIdentity = npm:aHJpZG95LXVsdGltYXRl:1.0.0 similarity = 0.485 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

8 flagged · loading source

scripts/check.jsView file

3// and that every external require() is declared in package.json. L4: const fs = require("fs"), path = require("path"), { spawnSync } = require("child_process"); L5: const root = path.resolve(__dirname, "..");

High

Child Process

Package source references child process execution.

scripts/check.jsView on unpkg · L3

2Cross-file remote execution chain: scripts/check.js spawns index.js; helper contains network access plus dynamic code execution. L2: // Syntax-checks every .js file and verifies relative require() targets exist L3: // and that every external require() is declared in package.json. L4: const fs = require("fs"), path = require("path"), { spawnSync } = require("child_process"); L5: const root = path.resolve(__dirname, ".."); L6: const skip = new Set(["node_modules", ".git"]); ... L18: const r = spawnSync(process.execPath, ["--check", f], { encoding: "utf8" }); L19: if (r.status !== 0) { bad++; console.error("SYNTAX " + rel + "\n" + r.stderr); continue; } L20: const src = fs.readFileSync(f, "utf8");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/check.jsView on unpkg · L2

e2ee.jsView file

Findings

1 Critical4 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltaindex.js

HighChild Processscripts/check.js

HighCross File Remote Execution Contextscripts/check.js

HighSemantic Analysis Limitedindex.js#virtual:normalized:round1

HighKnown Malware Source Similaritysrc/getAccess.js

MediumDynamic RequirecheckUpdate.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybuild/messagix.so

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvale2ee.js

LowFilesystem

Affected versions and remediation

This report applies to hridoy-ultimate@8.0.2.

See all versions of hridoy-ultimate for other recorded verdicts.

Review the evidence and your use of hridoy-ultimate@8.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 01:41:50.847Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.