Malicious code in hridoy-ultimate (npm)

hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that exhibits two critical malicious behaviors. First, its password-based login mechanism forwards Facebook email, password, and Base32 TOTP 2FA secrets to a hardcoded third-party endpoint (https://minhdong.site/api/v1/facebook/login_ios), enabling the operator of that endpoint to gain full access to user accounts. Second, the package.json references the 'fca-unofficial' dependency via a GitHub repository URL without a commit SHA or tag, causing npm to resolve and execute arbitrary code from the repository's default branch at install and runtime without any integrity verification or version locking. This introduces a severe supply chain risk. A separate WebSocket remote-control client exists but requires explicit opt-in and does not execute received data directly.

Users of hridoy-ultimate 8.0.0 risk full account compromise due to credential and 2FA secret exfiltration to a malicious third-party server. Additionally, arbitrary code execution during installation and runtime from an unpinned GitHub dependency exposes users to potential malware infection, data theft, or system compromise. This combination of credential theft and supply chain compromise presents a high security risk.

No official patch or remediation is indicated in the provided data. Users should immediately discontinue use of hridoy-ultimate 8.0.0. Avoid installing or running this package due to its malicious behaviors. Verify dependencies are pinned to specific commits or tags before installation to prevent arbitrary code execution. Monitor for vendor advisories for any future fixes or official guidance.