MalwarePublished 30 Sep 2026

fca-raihan (npm) · Malicious Code

Affects fca-raihanSource GCVE Database

Malicious package : remove fca-raihan and rotate any secrets on hosts that installed it.

Data as of 30 Sep 2026, 16:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17328

What to do

Remove fca-raihan from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfca-raihan	Affected =37.2.5 =37.2.6	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'fca-raihan' versions 37.2.5 and 37.2.6 declare a dependency on themselves via an off-registry GitHub source without a pinned reference or integrity check. This allows the repository owner to change the installed code at any time, potentially introducing malicious code during installation. The package includes base64 decoding and references consistent with its advertised messaging and end-to-end encryption functionality, but these are not independently verifiable without examining the mutable GitHub source at install time.

Impact

The vulnerability allows an attacker controlling the GitHub repository to execute arbitrary code during package installation by modifying the repository's HEAD. This can lead to supply chain compromise, potentially resulting in the installation of malicious code on users' systems who install the affected package versions. There is no evidence of known exploits in the wild at this time.

Defensive guidance

Users should avoid installing versions 37.2.5 and 37.2.6 of 'fca-raihan' due to the risk of arbitrary code execution from the mutable GitHub dependency. Until a fixed version or official advisory is available, consider using alternative packages or verifying the integrity of dependencies manually. Monitor the GitHub repository for changes and avoid installing packages with unpinned off-registry dependencies.

Summary

The 'fca-raihan' npm package versions 37.2.5 and 37.2.6 have a self-named dependency declared in their package.json that points to a GitHub repository (github:raihan9099/fca-raihan) without a fixed commit reference or integrity verification. During 'npm install', the current HEAD of this repository is fetched and installed, including any lifecycle scripts, allowing whoever controls the GitHub repository to alter the installed code arbitrarily and independently of the npm registry version. This dependency confusion pattern creates a risk of supply chain compromise. While some code patterns related to messaging and encryption are present, they do not confirm or deny malicious behavior without analyzing the mutable source fetched at install time.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:39 UTC

Technical details

References

Community reviews