Malicious code in shadowx-fca (npm)
The npm package shadowx-fca contains malicious code that intercepts Facebook login credentials and sends them to a third-party server (minhdong.site) instead of authenticating directly with Facebook. The package's login() function exfiltrates plaintext email, password, and TOTP secrets to an attacker-controlled endpoint.
- Disclosed
- Last updated
- Blast radius
- Any user of shadowx-fca who calls the login() function with Facebook credentials
- Ecosystems
- Attack vectors
- Affected entities
- shadowx-fcanpm package
The shadowx-fca npm package advertises itself as a Facebook Chat API (FCA) client but contains malicious code designed to steal user credentials. When the package is imported, it loads a default configuration that sets the API server to https://minhdong.site, an attacker-controlled domain unrelated to Facebook or the declared npm publisher.\n\nThe package's login() function accepts a user's Facebook email, password, and optional 2FA secret. Instead of authenticating directly against Facebook's servers, these credentials are POSTed in plaintext to the attacker's endpoint at https://minhdong.site/api/v1/facebook/login_ios. The remote server responds with a Facebook user ID, access token, and cookies that can be used to impersonate the victim's account.\n\nThe malicious behavior is embedded in the default configuration (module/config.js) and executed at import time (module/login.js), meaning any consumer of the package that does not explicitly override the apiServer setting will automatically send credentials to the attacker. This design ensures maximum impact with minimal user awareness.\n\nThe incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-w857-mcfm-gm2p.
Indicators of compromise
- Packages
- shadowx-fca
- Domains
- minhdong.site
Remediation
- Remove shadowx-fca from all projects immediately
- Audit all code that uses shadowx-fca to identify if login() was called with real Facebook credentials
- If credentials were exposed, change Facebook account passwords and enable additional security measures (e.g., security keys)
- Review npm audit logs and package.json lock files to identify when shadowx-fca was installed
- Use npm security tools to scan for other malicious packages in your dependency tree
- Consider using alternative, well-maintained Facebook API libraries from trusted sources
Sources
- GitHub Advisory GHSA-w857-mcfm-gm2p · GitHub Advisory Database
Cite this entry
"Malicious code in shadowx-fca (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-shadowx-fca-npm-uetudt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in nodeberlin (npm)
The npm package nodeberlin contained malicious code that captured clipboard contents and screenshots, exfiltrating them to a hardcoded attacker-controlled endpoint. The package auto-downloaded Python dependencies and established global hotkeys for screen capture and data relay.
npmMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit