Malicious Code Vulnerability in fca-raihan Package
Summary
MAL-2026-17328: Malicious code in fca-raihan (npm). Affects fca-raihan versions 37.2.5 – 37.2.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fca-raihan package is an npm library designed for messaging and end-to-end encryption (E2EE) functionalities. It allows developers to integrate secure messaging features into their applications. However, the package has a significant vulnerability due to its dependency management, which can lead to the installation of malicious code from an unverified source.
Vulnerability Detail
The vulnerability arises from the fca-raihan package declaring a dependency on itself with a source from GitHub. This off-registry dependency lacks a reference pin and integrity check, meaning that during installation, npm fetches the latest code from the GitHub repository. This allows the repository owner to modify the code at any time, potentially introducing malicious scripts. The self-referential nature of the dependency can lead to unintended code execution during normal installs, posing a risk to users who rely on this package for secure messaging.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall fca-raihanIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the fca-raihan package until the dependency issue is resolved. Consider using alternative packages that provide similar messaging and E2EE functionalities without the dependency risks.
Conclusion
The fca-raihan package has a critical vulnerability due to its self-referential dependency, which can lead to the installation of malicious code. Users are advised to update to the latest version or consider alternative packages to ensure the security of their applications. Regular monitoring and updates are essential for maintaining a secure environment.
See every vulnerability recorded for fca-raihan →
FAQ
The main issue is that it declares a self-referential dependency that can fetch unverified code from GitHub, potentially leading to the installation of malicious scripts.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
Using the fca-raihan package poses risks of executing malicious code, which can compromise the security of your application and its users.
Yes, updating to the latest version of the fca-raihan package will help mitigate the vulnerability.
If you cannot update the package right away, consider using alternative packages or implementing a temporary workaround by avoiding the use of fca-raihan.
