registry / maruf-fca / 1.2.29

maruf-fca@1.2.29

Unofficial Facebook Chat API for Node.js with Auto-Update System - Enhanced by ST | Sheikh Tamim

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Importing the package can modify the consumer project without an explicit update command. It queries npm and installs a newer package version, which may run that version's install hooks.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A consumer imports or requires index.js while a newer maruf-fca version exists.

Impact

Unconsented dependency mutation, process termination, and execution of future package lifecycle code.

Mechanism

Automatic registry-driven npm installation and consumer manifest rewrite.

Rationale

The package has no install hook, but its import-time automatic updater mutates a consumer project and installs remote code without consent. This is a concrete high-risk remote execution path, though the updater is limited to its own package name.

Evidence

index.jscheckUpdate.jslib/index.mjspackage.json

Network endpoints1

registry.npmjs.org/maruf-fca/latest

Decision evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Critical Vulnerability with medium false-positive risk.

maruf-fca@1.2.29

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code