Loading npm security reports…

maruf-fca@1.2.31: Malicious npm security report (Block) | LPM Firewall

registry / maruf-fca / 1.2.31

maruf-fca@1.2.31

Unofficial Facebook Chat API for Node.js with Auto-Update System - Enhanced by ST | Sheikh Tamim

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing index.js silently starts a self-update workflow. A newer publisher-controlled release causes npm to run in the consuming project, changes its package.json, and terminates the process.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A consumer imports or requires the package main entrypoint.

Impact

The package publisher can cause an unprompted dependency update and execution of the new release with the consumer process's privileges.

Mechanism

Import-time remote self-update followed by package-manager execution.

Attack narrative

A normal import schedules checkForFCAUpdate. If the registry reports a newer version, the package executes npm install maruf-fca@version --save in the application's working directory, rewrites that application's package.json, then exits. This gives the package publisher an automatic route to replace code in every importing project without an explicit update command. The imported E2EE stack also loads a shipped native library, increasing the consequences of an automatic update.

Rationale

The package contains an unconsented import-time self-updater that invokes npm with consumer-project privileges and changes consumer files. This is a concrete remote update and execution chain, not merely a static capability.

Evidence

index.jscheckUpdate.jspackage.jsonlib/index.mjsbuild/messagix.sobuild/messagix.dllprocess.cwd()/package.json

Network endpoints2

Source & flagged code

8 flagged · loading source

checkUpdate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = maruf-fca@1.2.29 matchedIdentity = npm:bWFydWYtZmNh:1.2.29 similarity = 0.990 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

checkUpdate.jsView on unpkg

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

89console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install maruf-fca@${version}...`); L90: execSync(`npm install maruf-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' }); L91: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L89

•matchType = normalized_sha256 matchedPackage = kurumi-fca@1.1.9 matchedPath = checkUpdate.js matchedIdentity = npm:a3VydW1pLWZjYQ:1.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

checkUpdate.jsView on unpkg

e2eebot.jsView file

12L13: const fs = require('fs'); L14: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

e2eebot.jsView on unpkg · L12

19async function importESM(specifier) { L20: const dynamicImport = new Function('specifier', 'return import(specifier)'); L21: return dynamicImport(specifier);

Low

Eval

Package source references a known benign dynamic code generation pattern.

e2eebot.jsView on unpkg · L19

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = fca-nx@1.7.3 matchedPath = src/getAccess.js matchedIdentity = npm:ZmNhLW54:1.7.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

Source & flagged code

8 flagged

checkUpdate.jsView file

Lines 1-21javascript

1const axios = require('axios');

2const { execSync } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

4const path = require('path');

5

6function getCurrentVersion() {

7 // 1. If this file is inside the maruf-fca package itself (development mode), use its own package.json

8 try {

9 const ownPkg = path.join(__dirname, 'package.json');

10 if (fs.existsSync(ownPkg)) {

11 const pkg = JSON.parse(fs.readFileSync(ownPkg, 'utf-8'));

12 if (pkg.name === 'maruf-fca' && pkg.version) return pkg.version;

13 }

14 } catch (_) { }

15

16 // 2. Installed as dependency in a user's project

17 try {

18 const nodeModulesPkg = path.join(process.cwd(), 'node_modules', 'maruf-fca', 'package.json');

19 if (fs.existsSync(nodeModulesPkg)) {

20 const pkg = JSON.parse(fs.readFileSync(nodeModulesPkg, 'utf-8'));

21 if (pkg.version) return pkg.version;

Lines 69-109javascript

69 }

70 } catch (error) {

71 console.log('\x1b[31m%s\x1b[0m', '❌ Failed to check for maruf-fca updates:', error.message);

72 return false;

73 }

74}

75

76

•matchType = previous_version_dangerous_delta matchedPackage = maruf-fca@1.2.29 matchedIdentity = npm:bWFydWYtZmNh:1.2.29 similarity = 0.990 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

checkUpdate.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = kurumi-fca@1.1.9 matchedPath = checkUpdate.js matchedIdentity = npm:a3VydW1pLWZjYQ:1.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

checkUpdate.jsView on unpkg

e2eebot.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2"use strict";

3

4/**

5 * ═══════════════════════════════════════════════════════════════════════════════

6 * E2EE Test Bot - maruf-fca E2EE System (NEW - Proper Implementation)

7 * ═══════════════════════════════════════════════════════════════════════════════

8 *

9 * Uses the new Client class from lib/index.mjs directly

10 * Properly initializes E2EE with device data and memory management

11 */

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = fca-nx@1.7.3 matchedPath = src/getAccess.js matchedIdentity = npm:ZmNhLW54:1.7.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg