Loading npm security reports…

hridoy-ultimate@9.0.2: Unknown npm security report (Allow) | LPM Firewall

registry / hridoy-ultimate / 9.0.2

hridoy-ultimate@9.0.2

⚠ Under review

Facebook Chat API by HR ID OY | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 20 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependency

scanned 143 file(s), 974 KB of source, external domains: 127.0.0.1, b-graph.facebook.com, facebook.com, github.com, m.facebook.com, minhdong.site, reg-e2ee.facebook.com, registry.npmjs.org, static.xx.fbcdn.net, upload.facebook.com, www.facebook.com, www.messenger.com, www.whatsapp.com

Source & flagged code

12 flagged · loading source

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

303patternName = google_api_key severity = high line = 303

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

303patternName = google_api_key severity = high line = 303

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

80// eslint-disable-next-line no-new-func L81: return new Function("s", "return import(s)")(specifier); L82: }

Low

Eval

Findings

9 High6 Medium5 Low

HighHigh Secretsrc/api/socket/e2ee/vendor/fme/dist/index.cjs

HighSemantic Analysis Limitedsrc/api/socket/e2ee/index.js#virtual:normalized:round1

HighKnown Malware Source Similaritysrc/api/messaging/uploadAttachment.js

HighKnown Malware Source Similaritysrc/api/socket/e2ee/index.js

HighKnown Malware Source Similaritymodule/config.js

HighKnown Malware Source Similaritysrc/api/socket/core/getSeqID.js

HighKnown Malware Source Similaritysrc/api/threads/getThreadInfo.js

HighKnown Malware Source Similaritysrc/api/users/getUserInfo.js

HighSecret Patternsrc/api/socket/e2ee/vendor/fme/dist/index.cjs

MediumDynamic Requiremodule/loginHelper.js

Medium

Affected versions and remediation

This report applies to hridoy-ultimate@9.0.2.

See all versions of hridoy-ultimate for other recorded verdicts.

Review the evidence and your use of hridoy-ultimate@9.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 11:28:04.585Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Source & flagged code

12 flagged

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

303patternName = google_api_key severity = high line = 303

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

303patternName = google_api_key severity = high line = 303

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

80// eslint-disable-next-line no-new-func L81: return new Function("s", "return import(s)")(specifier); L82: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/native/nativeMediaBridge.jsView on unpkg · L80

module/loginHelper.jsView file

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

src/api/socket/e2ee/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/api/socket/e2ee/index.js#virtual:normalized:round1View on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = hridoy-ultimate@8.0.0 matchedPath = [redacted].js matchedIdentity = npm:aHJpZG95LXVsdGltYXRl:8.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = hridoy-ultimate@8.0.0 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:aHJpZG95LXVsdGltYXRl:8.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

module/config.jsView file

•matchType = normalized_sha256 matchedPackage = hridoy-ultimate@8.0.0 matchedPath = module/config.js matchedIdentity = npm:aHJpZG95LXVsdGltYXRl:8.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = hridoy-ultimate@8.0.0 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:aHJpZG95LXVsdGltYXRl:8.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = hridoy-ultimate@8.0.0 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:aHJpZG95LXVsdGltYXRl:8.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = hridoy-ultimate@8.0.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:aHJpZG95LXVsdGltYXRl:8.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg