shadowx-fca

{"modified":"2026-08-06T23:29:21Z","published":"2026-08-06T19:48:01Z","schema_version":"1.7.4","id":"MAL-2026-13457","summary":"Malicious code in shadowx-fca (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5e05ec19966fd3fff65969ab898a3b25da7e1fa0baf271ee9b75dadad8513c27)\nThe package advertises a Facebook Chat API (FCA) client. Its default-exported login() function accepts email, password, and an optional 2FA secret and, via loginViaAPI/tokensViaAPI, POSTs those credentials to https://minhdong.site/api/v1/facebook/login_ios rather than authenticating directly against Facebook. The destination is set as the default apiServer in module/config.js (defaultConfig.apiServer = \"https://minhdong.site\") and loadConfig executes at import time from module/login.js, so any consumer that does not explicitly override apiServer sends plaintext Facebook email, password, and TOTP seed to this third-party host. The remote endpoint returns a Facebook uid, access token, and cookies that are then used to impersonate the account. The domain minhdong.site is unrelated to Facebook and to the declared npm publisher.\n","affected":[{"package":{"ecosystem":"npm","name":"shadowx-fca"},"versions":["10.0.0","10.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"module/loginHelper.js","sha256":"58ddcfdf87baa17521eeaae8f738ea50450cbbbaeba8b502bfda06f497653d73","tlsh":"7643b60d31fb202905732078678ba111756ae4533689cde9bb9ca3346f85529cebf7cb"},{"path":"module/config.js","sha256":"bf4b31532529bac1e438b32553d68cb4ada6aa555758876a95f166aecd00f2c9","tlsh":"7b11ef0315ff6673055989a0e1df10123d42c7c7210fb694a28cb65caf4e1a595f36ec"}],"package_integrity":[{"filename":"shadowx-fca-10.0.0.tgz","hashes":{"sha1":"e2eb7c0e9b085a35446a359c43832bcb949d56e9","sha512_sri":"sha512-blKYocZaE3hyyz18lTy25DGfRzQfBiAic+9ioRey/UgToeZmm/D3EAL54l2emgsh82cHj2+ckbvaiqG72kUSIw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/shadowx-fca/v/10.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/shadowx-fca/v/10.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016818","import_time":"2026-08-06T23:25:10.870574299Z","modified_time":"2026-08-06T19:48:01Z","sha256":"5e05ec19966fd3fff65969ab898a3b25da7e1fa0baf271ee9b75dadad8513c27","source":"amazon-inspector","versions":["10.0.0"]},{"id":"IN-MAL-2026-016819","import_time":"2026-08-06T23:25:10.898791767Z","modified_time":"2026-08-06T19:48:12Z","sha256":"8973ae32a1add1000f7914e9a86c0af54d24e70f3cf5610c3dcdf547bc20d76c","source":"amazon-inspector","versions":["10.1.0"]}]}}