MAL-2026-16057

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/toru-ultimate/MAL-2026-16057.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16057
Published
2026-09-08T23:56:12Z
Modified
2026-09-09T01:00:05Z
Summary
Malicious code in toru-ultimate (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f)

The package's loginViaAPI() function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios (a domain unrelated to Facebook, tied to the package's contributor). The response returns Facebook cookies/access_token which are then installed into the caller's session. The README documents login via appState cookies and does not disclose that email/password logins are proxied through minhdong.site. Additionally, package.json declares 'fca-unofficial' as 'github:VangBanLaNhat/fca-unofficial' — an unpinned mutable GitHub reference with no commit SHA. npm install fetches whatever bytes the branch HEAD returns, with no integrity check, and this module is require'd by the bundled E2EE client, so its code runs at import. Whoever controls that GitHub branch controls code delivered to every installer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019723",
            "import_time": "2026-09-09T00:47:57.680282813Z",
            "modified_time": "2026-09-08T23:56:12Z",
            "sha256": "e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / toru-ultimate

Package

Name
toru-ultimate
View open source insights on deps.dev
Purl
pkg:npm/toru-ultimate

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "b90519fb615ca609bc963d317945fb28d64d297197c97e15481be313c08ae331",
            "tlsh": "94419c36cd789db30fc46ae598691942722288578c54fc1d77ca025c8f9e06f23fda2e"
        },
        {
            "path": "module/loginHelper.js",
            "sha256": "56f248be0834492aeb7e4cdeede00594c6e5fccf0a9be55cd36da920034d56e6",
            "tlsh": "eb43c70d31fb102506732078678ba111756ae4533689cde9bb9ca3386f85529cbbf7cb"
        },
        {
            "path": "src/remote/remoteClient.js",
            "sha256": "b3b67a5eead971c4575b2d910858955937cec7bc638c49383dda93726e9f6ccf",
            "tlsh": "6c51ab5e94f3612243b3202e4b9bc4267122d153231eee907b8d83a0df696ec92e37d5"
        }
    ],
    "package_integrity": [
        {
            "filename": "toru-ultimate-1.0.0.tgz",
            "hashes": {
                "sha1": "af8436ccf6abec3a85be917e994971cc282c0354",
                "sha512_sri": "sha512-mB3Na31g16UCAce8WTfwYdRzEwG3zDf51wGdN+n4Eg+2pJ9fFqdNeCGywx+0nmh+8d0nUdRfBnwdT9H8yjbcVQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/toru-ultimate/MAL-2026-16057.json"