Loading npm security reports…

toru-ultimate@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / toru-ultimate / 1.0.0

toru-ultimate@1.0.0

Facebook Chat API by HR ID OY | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16057 confirms this npm version as malicious. The package's loginViaAPI() function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios (a domain unrelated to Facebook, tied to the package's contributor). The response returns Facebook cookies/access_token which are then installed into the caller's session...

Advisory

MAL-2026-16057

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in toru-ultimate (npm)

Details

The package's loginViaAPI() function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios (a domain unrelated to Facebook, tied to the package's contributor). The response returns Facebook cookies/access_token which are then installed into the caller's session. The README documents login via appState cookies and does not disclose that email/password logins are proxied through minhdong.site. Additionally, package.json declares 'fca-unofficial' as 'github:VangBanLaNhat/fca-unofficial' — an unpinned mutable GitHub reference with no commit SHA. npm install fetches whatever bytes the branch HEAD returns, with no integrity check, and this module is require'd by the bundled E2EE client, so its code runs at import. Whoever controls that GitHub branch controls code delivered to every installer.

Decision reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

References

OSV advisory PACKAGE

Decision evidence

Source & flagged code

12 flagged

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

Lines 283-323javascript

283 "kyc-id",

284 "privacy_token",

285 "readreceipts",

286 "appointment_only",

287 "address",

288 "expected_ts",

289 "privacy",

290 "7",

291 "android",

292 "interactive",

293 "device-identity",

294 "enabled",

295 "attribute_padding",

296 "1080",

297 "03",

298 "screen_height"

299];

300var DoubleByteTokens = [

301 ["read-self", "active", "fbns", "protocol", "reaction", "screen_width", "heartbeat", "deviceid", "2:47DEQpj8", "uploadfieldstat", "voip_settings", "retry", "priority", "longitude", "conflict", "false", "ig_professional"

302 ["reject", "dirty", "announcement", "020", "13", "9", "status_video_max_bitrate", "fb:thrift_iq", "offline_batch", "022", "full", "ctwa_first_business_reply_logging", "h.264", "smax_id", "group_description_length", "https://www.whatsapp.com/otp/code", "status_image_max_edge"

303 ["64", "ptt_playback_speed_enabled", "web_product_list_message_enabled", "paid_convo_ts", "27", "manufacturer", "psp-routing", "grp_uii_cleanup", "ptt_draft_enabled", "03c", "business_initiated", "web_catalog_products_onoff", "web_upload_link_thumb_mms_enabled", "03e", "mediaretry", "35",

304 ["1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746", "pricing_model", "056", "059", "061", "1119", "6027", "65", "877",

305];

306var TokenToIndex = {};

307SingleByteTokens.forEach((token, idx) => {

308 if (token) TokenToIndex[token] = idx;

309});

310var DoubleTokenToIndex = {};

311DoubleByteTokens.forEach((dict, dictIdx) => {

312 dict.forEach((token, tokenIdx) => {

313 if (token) DoubleTokenToIndex[token] = { dict: dictIdx, index: tokenIdx };

314 });

315});

316

317// src/e2ee/transport/binary/decoder.ts

318var import_node_zlib = require("node:zlib");

319var BinaryDecoder = class {

320 data;

321 index = 0;

322 constructor(data) {

323 this.data = data;

Long lines were clipped for display.

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

Lines 60-100javascript

60}

62/**

63 * Wraps a native-engine call with a hard timeout. A hung native call (e.g.

64 * a stuck getDeviceList/usync query) was observed blocking the whole

65 * process — including the unrelated MQTT connection — for 80+ seconds,

66 * taking down the entire bot (all threads, not just the one send). This

67 * makes any single native call fail fast instead of hanging indefinitely.

68 */

69function

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/socket/e2ee/index.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = src/api/socket/e2ee/index.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

module/config.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.2.0 matchedPath = module/config.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = src/api/socket/core/getSeqID.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

•matchType = normalized_sha256 matchedPackage = @eryxenx/fca@1.1.1 matchedPath = src/api/threads/getThreadInfo.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

•matchType = normalized_sha256 matchedPackage = fca-uzair-dev@1.2.0 matchedPath = src/api/users/getUserInfo.js matchedIdentity = npm:ZmNhLXV6YWlyLWRldg:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

Source & flagged code

12 flagged · loading source

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

303patternName = google_api_key severity = high line = 303

High

High Secret

Package contains a high-severity secret pattern.

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

303patternName = google_api_key severity = high line = 303

High

Secret Pattern

Google API key in src/api/socket/e2ee/vendor/fme/dist/index.cjs

src/api/socket/e2ee/vendor/fme/dist/index.cjsView on unpkg · L303

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

80// eslint-disable-next-line no-new-func L81: return new Function("s", "return import(s)")(specifier); L82: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/api/socket/e2ee/native/nativeMediaBridge.jsView on unpkg · L80

module/loginHelper.jsView file

•matchType = token_shingles matchedPackage = @eryxenx/fca@1.1.1 matchedPath = module/loginHelper.js matchedIdentity = npm:QGVyeXhlbngvZmNh:1.1.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/loginHelper.jsView on unpkg

1"use strict"; L2: const fs = require("fs"); L3: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/socket/e2ee/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

module/config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

Source & flagged code

12 flagged

src/api/socket/e2ee/vendor/fme/dist/index.cjsView file

Lines 283-323javascript

283 "kyc-id",

284 "privacy_token",

285 "readreceipts",

286 "appointment_only",

287 "address",

288 "expected_ts",

289 "privacy",

290 "7",

291 "android",

292 "interactive",

293 "device-identity",

294 "enabled",

295 "attribute_padding",

296 "1080",

297 "03",

298 "screen_height"

299];

300var DoubleByteTokens = [

304 ["1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746", "pricing_model", "056", "059", "061", "1119", "6027", "65", "877",

305];

306var TokenToIndex = {};

307SingleByteTokens.forEach((token, idx) => {

308 if (token) TokenToIndex[token] = idx;

309});

310var DoubleTokenToIndex = {};

311DoubleByteTokens.forEach((dict, dictIdx) => {

312 dict.forEach((token, tokenIdx) => {

313 if (token) DoubleTokenToIndex[token] = { dict: dictIdx, index: tokenIdx };

314 });

315});

316

317// src/e2ee/transport/binary/decoder.ts

318var import_node_zlib = require("node:zlib");

319var BinaryDecoder = class {

320 data;

321 index = 0;

322 constructor(data) {

323 this.data = data;

Long lines were clipped for display.

src/api/socket/e2ee/native/nativeMediaBridge.jsView file

Lines 60-100javascript

60}

62/**

63 * Wraps a native-engine call with a hard timeout. A hung native call (e.g.

64 * a stuck getDeviceList/usync query) was observed blocking the whole

65 * process — including the unrelated MQTT connection — for 80+ seconds,

66 * taking down the entire bot (all threads, not just the one send). This

67 * makes any single native call fail fast instead of hanging indefinitely.

68 */

69function

module/loginHelper.jsView file

Lines 1-21javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

module/loginHelper.jsView on unpkg · L1

src/api/socket/e2ee/native/build/messagix.soView file

•path = [redacted].so kind = native_binary sizeBytes = 17504872 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/api/socket/e2ee/native/build/messagix.soView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/api/socket/e2ee/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/e2ee/index.jsView on unpkg

module/config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

module/config.jsView on unpkg

src/api/socket/core/getSeqID.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/socket/core/getSeqID.jsView on unpkg

src/api/threads/getThreadInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/threads/getThreadInfo.jsView on unpkg

src/api/users/getUserInfo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/api/users/getUserInfo.jsView on unpkg

toru-ultimate@1.0.0

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code