MAL-2026-13457

    Dashboard / Malicious Package / MAL-2026-13457

    MAL-2026-13457

    Published: 6 Aug 2026Last Modified: 6 Aug 2026

    Summary: Malicious code in shadowx-fca (npm)

    Details: Source: amazon-inspector (5e05ec19966fd3fff65969ab898a3b25da7e1fa0baf271ee9b75dadad8513c27) The package advertises a Facebook Chat API (FCA) client. Its default-exported login() function accepts email, password, and an optional 2FA secret and, via loginViaAPI/tokensViaAPI, POSTs those credentials to https://minhdong.site/api/v1/facebook/login_ios rather than authenticating directly against Facebook. The destination is set as the default apiServer in module/config.js (defaultConfig.apiServer = "https://minhdong.site") and loadConfig executes at import time from module/login.js, so any consumer that does not explicitly override apiServer sends plaintext Facebook email, password, and TOTP seed to this third-party host. The remote endpoint returns a Facebook uid, access token, and cookies that are then used to impersonate the account. The domain minhdong.site is unrelated to Facebook and to the declared npm publisher.

    References: https://www.npmjs.com/package/shadowx-fca/v/10.0.0, https://www.npmjs.com/package/shadowx-fca/v/10.1.0

    Affected packages

    Package

    Name: shadowx-fca

    Purl: pkg:npm/shadowx-fca

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.0.0