GCVE-110-OSM-2026-14061

hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in module/loginHelper.js forwards caller-supplied Facebook email, password, and Base32 TOTP 2FA secret to a hardcoded third-party endpoint at https://minhdong.site/api/v1/facebook/login_ios (default baked into module/config.js, not disclosed in README) and receives the resulting Facebook session cookies / access_token back through that server, giving the operator of minhdong.site full access to any account whose credentials pass through this path. Second, package.json declares `fca-unofficial` as `github:VangBanLaNhat/fca-unofficial` with no commit SHA or tag; npm resolves this against whatever the referenced repository's default branch contains at install time, and the vendor bundle under src/api/socket/e2ee/ actually requires that module, so arbitrary code controlled by that GitHub repo owner is pulled and executed on the installer at install and load time with no integrity check and no version lock. A separate opt-in WebSocket remote-control client (src/remote/remoteClient.js) is config-gated and does not itself exec received data. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in src/changeAvatar.js: ".profile" - Startup Persistence in src/changeCover.js: ".profile" - Startup Persistence in src/createPost.js: ".profile" - Startup Persistence in src/follow.js: ".profile" - Startup Persistence in src/friendList.js: ".profile" - Startup Persistence in src/getUserInfo.js: ".profile" - Startup Persistence in src/sendFriendRequest.js: ".profile" - Startup Persistence in src/suggestFriend.js: ".profile" DESTINATION - 9 exfil (reconstructed, custom-c2) - 2 c2 (domains) - 3 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/index.mjs: "Buffer.from(bytes).toString("base64")" - Data Encoding for Exfiltration in src/createCommentPost.js: "Buffer.from('feedback:' + postID).toString('base64')" - Data Encoding for Exfiltration in src/getAccess.js: "encodeURIComponent(url + 'content_management') + '&type=avoid_bypass&app_id=0&sa..." - Data Encoding for Exfiltration in src/sendComment.js: "Buffer.from("feedback:" + postId).toString("base64")" - Data Encoding for Exfiltration in utils.js: "encodeURIComponent(str" - Network Request in checkUpdate.js: "https.get(" - System Information Collection in lib/index.mjs: "process.platform" - Network Request in src/getUID.js: "axios.post(" OBFUSCATION - IOCs Found in Deobfuscated Code in e2ee.js - IOCs Found in Deobfuscated Code in lib/index.mjs - Dynamic Base64 Decoding in e2ee.js: "Buffer.from(input, "base64")" - Dynamic Base64 Decoding in lib/index.mjs: "Buffer.from(trimmed, "base64")" - Dynamic Base64 Decoding in src/setStorySeen.js: "Buffer.from(storyID, 'base64')" - Base64 Encoded Payload in src/searchFriends.js: ""YXBwX2NvbGxlY3Rpb246cGZiaWQwMkJSM3NDeXRjNkJIeVVXem9OeUxNcjNoYnVDclRFZkdCcVlEaXZ..." - String Array Obfuscation in utils.js: "[ "Phương Chi", "An Bình", "An Di", "An Hạ", "An Hằng", "An Khê", "An Nhiên", "A..." - Obfuscation (osm-deobfuscator): unknown in src/sendComment.js (+5 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in src/getAccess.js: "https://business.facebook.com/content_management" - Platform Detection with Data Collection in index.js: "JSON.stringify({w:1440,h:900,aw:1440,ah:834,c:24})).toS" - Dynamic Code Execution in scripts/check.js: "exec(src)" - Shell Command Execution in scripts/check.js: "require("child_process")" - Suspicious URL Pattern in Template Literal in src/changeAvatarV2.js: "https://www.facebook.com/profile/picture/upload/?profile_id=${...}&photo_source=..." - Very New NPM Publisher Account PAYLOAD FILES src/getAccess.js (+ lib/index.mjs, e2ee.js)