MAL-2026-13457

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shadowx-fca/MAL-2026-13457.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13457
Published
2026-08-06T19:48:01Z
Modified
2026-08-06T23:50:20.421614873Z
Summary
Malicious code in shadowx-fca (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5e05ec19966fd3fff65969ab898a3b25da7e1fa0baf271ee9b75dadad8513c27)

The package advertises a Facebook Chat API (FCA) client. Its default-exported login() function accepts email, password, and an optional 2FA secret and, via loginViaAPI/tokensViaAPI, POSTs those credentials to https://minhdong.site/api/v1/facebook/login_ios rather than authenticating directly against Facebook. The destination is set as the default apiServer in module/config.js (defaultConfig.apiServer = "https://minhdong.site") and loadConfig executes at import time from module/login.js, so any consumer that does not explicitly override apiServer sends plaintext Facebook email, password, and TOTP seed to this third-party host. The remote endpoint returns a Facebook uid, access token, and cookies that are then used to impersonate the account. The domain minhdong.site is unrelated to Facebook and to the declared npm publisher.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T19:48:01Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016818",
            "import_time": "2026-08-06T23:25:10.870574299Z",
            "sha256": "5e05ec19966fd3fff65969ab898a3b25da7e1fa0baf271ee9b75dadad8513c27",
            "versions": [
                "10.0.0"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T19:48:12Z",
            "sha256": "8973ae32a1add1000f7914e9a86c0af54d24e70f3cf5610c3dcdf547bc20d76c",
            "import_time": "2026-08-06T23:25:10.898791767Z",
            "id": "IN-MAL-2026-016819",
            "versions": [
                "10.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / shadowx-fca

Package

Name
shadowx-fca
View open source insights on deps.dev
Purl
pkg:npm/shadowx-fca

Affected ranges

Affected versions

10.*
10.0.0
10.1.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "shadowx-fca-10.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-blKYocZaE3hyyz18lTy25DGfRzQfBiAic+9ioRey/UgToeZmm/D3EAL54l2emgsh82cHj2+ckbvaiqG72kUSIw==",
                "sha1": "e2eb7c0e9b085a35446a359c43832bcb949d56e9"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "7643b60d31fb202905732078678ba111756ae4533689cde9bb9ca3346f85529cebf7cb",
            "sha256": "58ddcfdf87baa17521eeaae8f738ea50450cbbbaeba8b502bfda06f497653d73",
            "path": "module/loginHelper.js"
        },
        {
            "tlsh": "7b11ef0315ff6673055989a0e1df10123d42c7c7210fb694a28cb65caf4e1a595f36ec",
            "sha256": "bf4b31532529bac1e438b32553d68cb4ada6aa555758876a95f166aecd00f2c9",
            "path": "module/config.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shadowx-fca/MAL-2026-13457.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]