MAL-2026-16057

    Dashboard / Malicious Package / MAL-2026-16057

    MAL-2026-16057

    Published: 8 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in toru-ultimate (npm)

    Details: Source: amazon-inspector (e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f) The package's loginViaAPI() function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios (a domain unrelated to Facebook, tied to the package's contributor). The response returns Facebook cookies/access_token which are then installed into the caller's session. The README documents login via appState cookies and does not disclose that email/password logins are proxied through minhdong.site. Additionally, package.json declares 'fca-unofficial' as 'github:VangBanLaNhat/fca-unofficial' — an unpinned mutable GitHub reference with no commit SHA. npm install fetches whatever bytes the branch HEAD returns, with no integrity check, and this module is require'd by the bundled E2EE client, so its code runs at import. Whoever controls that GitHub branch controls code delivered to every installer.

    References: https://www.npmjs.com/package/toru-ultimate/v/1.0.0

    Affected packages

    Package

    Name: toru-ultimate

    Purl: pkg:npm/toru-ultimate

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0