Malicious code in shadowx-fca (npm)
The shadowx-fca npm package contains malicious code that intercepts Facebook login credentials. Its login function sends user email, password, and optional 2FA secret to a third-party server (https://minhdong.site) instead of Facebook, exposing sensitive data. This allows the attacker to obtain Facebook user IDs, access tokens, and cookies to impersonate accounts. The malicious behavior is present in versions 10.0.0 and 10.1.0 of the package.
AI Analysis
Technical Summary
The shadowx-fca npm package advertises itself as a Facebook Chat API client. However, its default login() function does not authenticate directly with Facebook. Instead, it sends the user's Facebook email, password, and optional two-factor authentication secret in plaintext to a third-party server at https://minhdong.site, which is unrelated to Facebook or the npm publisher. This server returns Facebook user identifiers, access tokens, and cookies that enable account impersonation. The malicious endpoint is set as the default API server in the package's configuration and is used automatically unless explicitly overridden by the consumer. This behavior is present in versions 10.0.0 and 10.1.0 of shadowx-fca.
Potential Impact
Users of shadowx-fca versions 10.0.0 and 10.1.0 who call the login function risk having their Facebook credentials and 2FA secrets sent in plaintext to an attacker-controlled server. This compromises account confidentiality and allows the attacker to impersonate the user by using returned access tokens and cookies. The compromise can lead to unauthorized access and potential misuse of Facebook accounts.
Mitigation Recommendations
No official patch or remediation is currently documented. Consumers should avoid using shadowx-fca versions 10.0.0 and 10.1.0. If usage is necessary, explicitly override the default apiServer configuration to prevent credentials from being sent to the malicious third-party server. Monitor vendor advisories for updates or official fixes. Consider using alternative, trusted Facebook API clients.
Malicious code in shadowx-fca (npm)
Description
The shadowx-fca npm package contains malicious code that intercepts Facebook login credentials. Its login function sends user email, password, and optional 2FA secret to a third-party server (https://minhdong.site) instead of Facebook, exposing sensitive data. This allows the attacker to obtain Facebook user IDs, access tokens, and cookies to impersonate accounts. The malicious behavior is present in versions 10.0.0 and 10.1.0 of the package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The shadowx-fca npm package advertises itself as a Facebook Chat API client. However, its default login() function does not authenticate directly with Facebook. Instead, it sends the user's Facebook email, password, and optional two-factor authentication secret in plaintext to a third-party server at https://minhdong.site, which is unrelated to Facebook or the npm publisher. This server returns Facebook user identifiers, access tokens, and cookies that enable account impersonation. The malicious endpoint is set as the default API server in the package's configuration and is used automatically unless explicitly overridden by the consumer. This behavior is present in versions 10.0.0 and 10.1.0 of shadowx-fca.
Potential Impact
Users of shadowx-fca versions 10.0.0 and 10.1.0 who call the login function risk having their Facebook credentials and 2FA secrets sent in plaintext to an attacker-controlled server. This compromises account confidentiality and allows the attacker to impersonate the user by using returned access tokens and cookies. The compromise can lead to unauthorized access and potential misuse of Facebook accounts.
Mitigation Recommendations
No official patch or remediation is currently documented. Consumers should avoid using shadowx-fca versions 10.0.0 and 10.1.0. If usage is necessary, explicitly override the default apiServer configuration to prevent credentials from being sent to the malicious third-party server. Monitor vendor advisories for updates or official fixes. Consider using alternative, trusted Facebook API clients.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13457
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7573b5bf8831d539d93b8a
Added to database: 08/07/2026, 05:57:09 UTC
Last enriched: 08/07/2026, 07:42:04 UTC
Last updated: 09/21/2026, 23:08:05 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.