registry / Remote code execution / maruf-fca
maruf-fca
Unofficial Facebook Chat API for Node.js with Auto-Update System - Enhanced by ST | Sheikh Tamim
This report shows the evidence for maruf-fca@1.2.31. 1 of 4 known versions is blocked or flagged. The newest version, 1.2.32, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains an unconsented import-time self-updater that invokes npm with consumer-project privileges and changes consumer files. This is a concrete remote update and execution chain, not merely a static capability.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A consumer imports or requires the package main entrypoint.
Impact
The package publisher can cause an unprompted dependency update and execution of the new release with the consumer process's privileges.
Mechanism
Import-time remote self-update followed by package-manager execution.
Attack narrative
A normal import schedules checkForFCAUpdate. If the registry reports a newer version, the package executes npm install maruf-fca@version --save in the application's working directory, rewrites that application's package.json, then exits. This gives the package publisher an automatic route to replace code in every importing project without an explicit update command. The imported E2EE stack also loads a shipped native library, increasing the consequences of an automatic update.
AI rationale
The package contains an unconsented import-time self-updater that invokes npm with consumer-project privileges and changes consumer files. This is a concrete remote update and execution chain, not merely a static capability.
Evidence
index.jscheckUpdate.jspackage.jsonlib/index.mjsbuild/messagix.sobuild/messagix.dllprocess.cwd()/package.json
Network endpoints2
registry.npmjs.org/maruf-fca/latestraw.githubusercontent.com/sheikhtamimlover/maruf-fca/main/CHANGELOG.md
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the main entrypoint schedules an update check without a user request.
- The import-time updater fetches the publisher-controlled latest version and runs npm install in the host project.
- The updater rewrites the host project's package.json dependency and exits the process after updating.
- The package has no npm lifecycle hook; the behavior is activated by runtime import instead.
- The native library is loaded only through the package's E2EE code, but it expands the impact of an unreviewable binary.
Evidence against
- The observed network calls mostly implement the advertised Facebook chat API.
- The dynamic import in the E2EE code targets a package-relative library, not a remote module.
- No source evidence shows credential exfiltration to an unrelated endpoint or AI-agent configuration changes.
Behavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket
Source & flagged code
8 flagged · loading sourcecheckUpdate.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = maruf-fca@1.2.29
matchedIdentity = npm:bWFydWYtZmNh:1.2.29
similarity = 0.990
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
checkUpdate.jsView on unpkg1const axios = require('axios');
L2: const { execSync } = require('child_process');
L3: const fs = require('fs');
High
89console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install maruf-fca@${version}...`);
L90: execSync(`npm install maruf-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' });
L91: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
checkUpdate.jsView on unpkg · L89Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous DeltacheckUpdate.js
HighChild ProcesscheckUpdate.js
HighRuntime Package InstallcheckUpdate.js
HighKnown Malware Source SimilaritycheckUpdate.js
HighKnown Malware Source Similaritysrc/getAccess.js
MediumDynamic Requiree2eebot.js
MediumNetwork
MediumShips Native Binarybuild/messagix.so
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvale2eebot.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to maruf-fca@1.2.31.
The versions list below shows the verdict for each recorded version.
- Avoid installing maruf-fca@1.2.31. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.