registry / Remote code execution / maruf-fca / 1.2.32

maruf-fca@1.2.32

Unofficial Facebook Chat API for Node.js with Auto-Update System - Enhanced by ST | Sheikh Tamim

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes an unconsented automatic package-manager and manifest mutation path at import time. This is a concrete dangerous capability, but the inspected code targets its own package and contains no direct malicious exfiltration or destructive payload.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Importing index.js; a newer version reported by the npm registry triggers the project mutation.

Impact

A package import can install registry-supplied code and rewrite the caller's dependency manifest.

Mechanism

Automatic self-update through npm plus optional native-library loading.

AI rationale

Evidence

package.jsonindex.jscheckUpdate.jslib/index.mjsbuild/messagix.sobuild/messagix.dll

Network endpoints3

registry.npmjs.org/maruf-fca/latestraw.githubusercontent.com/sheikhtamimlover/maruf-fca/main/CHANGELOG.mdraw.githubusercontent.com/sheikhtamimlover/ST-Handlers/refs/heads/main/maruf-fcakey.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Importing the main module automatically starts an update check.
A registry response can cause a synchronous npm install in the caller's working directory.
The update routine rewrites the caller's package.json.
The E2EE feature loads a stripped native shared library.
The API fetches image-hosting credentials from a remote GitHub file.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The automatic update targets the same package name and uses the public npm registry.
Most network calls implement the advertised Facebook chat API.
No source evidence shows environment harvesting or unrelated credential exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

9 flagged

checkUpdate.jsView file

Lines 1-21javascript

1const axios = require('axios');

2const { execSync } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

4const path = require('path');

6function getCurrentVersion() {

7 // 1. If this file is inside the maruf-fca package itself (development mode), use its own package.json

8 try {

9 const ownPkg = path.join(__dirname, 'package.json');

10 if (fs.existsSync(ownPkg)) {

11 const pkg = JSON.parse(fs.readFileSync(ownPkg, 'utf-8'));

12 if (pkg.name === 'maruf-fca' && pkg.version) return pkg.version;

13 }

14 } catch (_) { }

16 // 2. Installed as dependency in a user's project

17 try {

18 const nodeModulesPkg = path.join(process.cwd(), 'node_modules', 'maruf-fca', 'package.json');

19 if (fs.existsSync(nodeModulesPkg)) {

20 const pkg = JSON.parse(fs.readFileSync(nodeModulesPkg, 'utf-8'));

21 if (pkg.version) return pkg.version;

Lines 69-109javascript

69 }

70 } catch (error) {

71 console.log('\x1b[31m%s\x1b[0m', '❌ Failed to check for maruf-fca updates:', error.message);

72 return false;

73 }

74}

•matchType = previous_version_dangerous_delta matchedPackage = maruf-fca@1.2.29 matchedIdentity = npm:bWFydWYtZmNh:1.2.29 similarity = 0.969 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

checkUpdate.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = maruf-fca@1.2.31 matchedPath = checkUpdate.js matchedIdentity = npm:bWFydWYtZmNh:1.2.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

checkUpdate.jsView on unpkg

e2eebot.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * ═══════════════════════════════════════════════════════════════════════════════

6 * E2EE Test Bot - maruf-fca E2EE System (NEW - Proper Implementation)

7 * ═══════════════════════════════════════════════════════════════════════════════

8 *

9 * Uses the new Client class from lib/index.mjs directly

10 * Properly initializes E2EE with device data and memory management

11 */

build/messagix.soView file

•path = build/messagix.so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

build/messagix.soView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = maruf-fca@1.2.31 matchedPath = index.js matchedIdentity = npm:bWFydWYtZmNh:1.2.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = maruf-fca@1.2.31 matchedPath = src/getAccess.js matchedIdentity = npm:bWFydWYtZmNh:1.2.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

Source & flagged code

9 flagged · loading source

checkUpdate.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

checkUpdate.jsView on unpkg

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

89console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install maruf-fca@${version}...`); L90: execSync(`npm install maruf-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' }); L91: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L89

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous DeltacheckUpdate.js

HighChild ProcesscheckUpdate.js

HighRuntime Package InstallcheckUpdate.js

HighKnown Malware Source SimilaritycheckUpdate.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Similaritysrc/getAccess.js

MediumDynamic Requiree2eebot.js

MediumNetwork

MediumShips Native Binarybuild/messagix.so

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvale2eebot.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to maruf-fca@1.2.32.

See all versions of maruf-fca for other recorded verdicts.

Review the evidence and your use of maruf-fca@1.2.32 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 05:50:53.837Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code