MAL-2026-16057
Malicious code in toru-ultimate (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f) The package's loginViaAPI() function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios (a domain unrelated to Facebook, tied to the package's contributor). The response returns Facebook cookies/access_token which are then installed into the caller's session. The README documents login via appState cookies and does not disclose that email/password logins are proxied through minhdong.site. Additionally, package.json declares 'fca-unofficial' as 'github:VangBanLaNhat/fca-unofficial' — an unpinned mutable GitHub reference with no commit SHA. npm install fetches whatever bytes the branch HEAD returns, with no integrity check, and this module is require'd by the bundled E2EE client, so its code runs at import. Whoever controls that GitHub branch controls code delivered to every installer.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for toru-ultimate (npm). Pin to a known-safe version or switch to an alternative.