GCVE-110-OSM-2026-11899

The package's loginViaAPI() function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios (a domain unrelated to Facebook, tied to the package's contributor). The response returns Facebook cookies/access_token which are then installed into the caller's session. The README documents login via appState cookies and does not disclose that email/password logins are proxied through minhdong.site. Additionally, package.json declares 'fca-unofficial' as 'github:VangBanLaNhat/fca-unofficial' — an unpinned mutable GitHub reference with no commit SHA. npm install fetches whatever bytes the branch HEAD returns, with no integrity check, and this module is require'd by the bundled E2EE client, so its code runs at import. Whoever controls that GitHub branch controls code delivered to every installer. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in src/api/action/changeAvatar.js: ".profile" - Startup Persistence in src/api/users/getUserInfo.js: ".profile" - Startup Persistence in src/api/users/getUserInfoV2.js: ".profile" - Startup Persistence in src/app/threadInfoRealtimeSync.js: ".profile" - Startup Persistence in src/utils/nexca-utils.js: ".profile" DESTINATION - 20 exfil (custom-c2, reconstructed) - 1 c2 (domains) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in src/api/socket/e2ee/vendor/fme/dist/index.cjs: "process.env.FB_E2EE_MEDIA_UPLOAD_AUTH ? { host: process.env.FB_E2EE_MEDIA_UPLOAD..." - Data Encoding for Exfiltration in src/api/action/setPostReaction.js: "Buffer.from("feedback:" + postID).toString("base64")" - Data Encoding for Exfiltration in src/api/messaging/uploadAttachment.js: "encodeURIComponent(userId" - Data Encoding for Exfiltration in src/api/socket/e2ee/index.js: "Buffer.from(meta.mediaKey).toString("base64")" - Data Encoding for Exfiltration in src/api/socket/e2ee/native/lib/index.mjs: "Buffer.from(bytes).toString("base64")" - Data Encoding for Exfiltration in src/api/socket/e2ee/vendor/fme/dist/index.cjs: "Buffer.from([5]).toString("base64")" - System Information Exfiltration in src/api/users/getUserInfo.js: "__dirname, "../../database", file)); acc[path.basename(file, ".js")] = typeof mo..." - Data Encoding for Exfiltration in src/utils/format/presence.js: "encodeURIComponent(str" (+6 more) OBFUSCATION - IOCs Found in Deobfuscated Code in src/api/socket/e2ee/native/lib/index.mjs - IOCs Found in Deobfuscated Code in src/api/socket/e2ee/ratchet.js - IOCs Found in Deobfuscated Code in src/api/socket/e2ee/vendor/fme/dist/index.cjs - Dynamic Base64 Decoding in src/api/socket/e2ee/native/lib/index.mjs: "Buffer.from(trimmed, "base64")" - Dynamic Base64 Decoding in src/api/socket/e2ee/ratchet.js: "Buffer.from(v, "base64")" - Dynamic Base64 Decoding in src/api/socket/e2ee/store.js: "Buffer.from(data, "base64")" - Dynamic Base64 Decoding in src/api/socket/e2ee/vendor/fme/dist/index.cjs: "Buffer.from(id, "base64")" - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in src/api/socket/e2ee/vendor/fme/dist/index.cjs (+3 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in src/api/action/setPostReaction.js: "JSON.stringify({ input: { actor_id: ctx.userID, feedback_id: Buffer.from("feedba..." - Dynamic Code Execution in src/api/messaging/uploadAttachment.js: "exec(s)" - Suspicious URL Pattern in Template Literal in src/api/messaging/uploadAttachment.js: "https://www.facebook.com/ajax/mercury/upload.php?${...}" PAYLOAD FILES src/api/socket/e2ee/vendor/fme/dist/index.cjs (+ src/api/messaging/uploadAttachment.js, src/api/socket/e2ee/native/lib/index.mjs)