{"items":[{"id":"NVI-00009838","kind":"supply_chain_event","title":"Malicious code in hridoy-ultimate (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8chm-j6jp-f4h3"],"plain_summary":"GitHub lists this malware advisory for hridoy-ultimate. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6f1bf70fd006b257c5725ca8a11d0768"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6f1bf70fd006b257c5725ca8a11d0768","url":"https://github.com/advisories/GHSA-8chm-j6jp-f4h3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8chm-j6jp-f4h3","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:53.250Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6f1bf70fd006b257c5725ca8a11d0768"],"technology":"hridoy-ultimate","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (221c8e51e1341e954c4f2ea3ea4a139606138c8ecc1ab99e17f403e304f05157)\nhridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in module/loginHelper.js forwards caller-supplied Facebook email, password, and Base32 TOTP 2FA secret to a hardcoded third-party endpoint at https://minhdong.site/api/v1/facebook/login_ios (default baked into module/config.js, not disclosed in README) and receives the resulting Facebook session cookies / access_token back through that server, giving the operator of minhdong.site full access to any account whose credentials pass through this path. Second, package.json declares `fca-unofficial` as `github:VangBanLaNhat/fca-unofficial` with no commit SHA or tag; npm resolves this against whatever the referenced repository's default branch contains at install time, and the vendor bundle under src/api/socket/e2ee/ actually requires that module, so arbitrary code controlled by that GitHub repo owner is pulled and executed on the installer at install and load time with no integrity check and no version lock. A separate opt-in WebSocket remote-control cl","public_affected_ranges":["= 8.0.0"]}],"null_published_at":"2026-10-31T22:13:39.949Z","source_updated_at":"2026-10-11T18:30:28.000Z","source_disclosed_at":"2026-10-11T18:30:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:53.250Z"}],"next_cursor":null,"snapshot_revision":"42594"}