{"id":"MAL-2026-4363","summary":"Malicious code in @asura21232/fca-unofficial-nextgen (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (30540a72a722c901403164aeb090ca99999d3be2cc4d9e9f3ad99ef319fc2db2)\nThis package presents itself as an unofficial Facebook Messenger client library, but its exported authentication helpers (`loginViaAPI`, `tokensViaAPI`, `tokens`) send the caller-supplied Facebook email, password, and 2FA secret to `https://api.fca-ng.top/api/v1/facebook/login_ios` by default rather than authenticating directly with facebook.com. The default destination is hardcoded in `src/engine/core/config.ts` (`apiServer: \"https://api.fca-ng.top\"`) and consumed in `src/engine/core/authHelpers.ts` line 62, which POSTs `{ email, password, twoFactor }` to that endpoint. The README does not disclose this third-party relay; consumers using the library to log a bot account into Facebook will silently hand their credentials to the package author's server on every login. The relay is opt-out (a consumer must override `apiServer`) rather than opt-in, which inverts the trust model expected of a Messenger client library. Additionally, `src/engine/core/updateCheck.ts` exposes a self-updater that can invoke `execFile('npm', ['i', '\u003cpkg\u003e@latest'])` when `config.install` is enabled — gated and not auto-triggered, but a secondary quality concern.\n","modified":"2026-05-27T00:31:59.531519289Z","published":"2026-05-22T04:35:10Z","withdrawn":"2026-05-26T21:14:22Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-05-26T05:52:00.073364165Z","modified_time":"2026-05-22T04:35:10Z","sha256":"30540a72a722c901403164aeb090ca99999d3be2cc4d9e9f3ad99ef319fc2db2","source":"amazon-inspector","versions":["2.0.1"],"id":"IN-MAL-2026-004133"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@asura21232/fca-unofficial-nextgen/v/2.0.1"}],"affected":[{"package":{"name":"@asura21232/fca-unofficial-nextgen","ecosystem":"npm","purl":"pkg:npm/%40asura21232%2Ffca-unofficial-nextgen"},"versions":["2.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/engine/core/authHelpers.ts","sha256":"84a3b3943e424adee94988a2502cfe1af361cd7c0fd3a409fede43b8d13b63af","tlsh":"0d02870d312a204a0a7263b4e7835214f75761d732d5c2babafca2642f3142ed972f9d"},{"path":"src/engine/core/updateCheck.ts","sha256":"21abfa35130e7f5f8535b304a065fbe27bd8f6d1c4aa7fbc8f9fd8a4e09d8238","tlsh":"32c132ca6527b5334a70a739da0a4418fb26ab7331058594fdee35103f37624e1abe9c"}],"package_integrity":[{"filename":"fca-unofficial-nextgen-2.0.1.tgz","hashes":{"sha1":"a862487df3f39a2ec18f7597bd690114e908ce09","sha512_sri":"sha512-tDJW+koBdg0kXc3Ywtp2pB6YYE3brVphPsrlIOq08bBEAZcO8KhEYO51FFngiWwZvDRhAz2vc6IeeXG+IICpZg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@asura21232/fca-unofficial-nextgen/MAL-2026-4363.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}