fuck2

by MOHAMMAD AKASH Developer — v3.2 — id #282

Overlay two users’ avatars on another NSFW image template (fun only)

views

likes

installs

Aliases: fck2

analysis — static scan, nothing executed

0 grade F

Dangerous — do not install without a full manual review

Security 80

Privacy 26

Quality 100

Maintenance 90

Community 16

critical Possible credential exfiltration

The file reads session data or secrets and also talks to the network. Verify nothing sensitive is being sent out.

L46

`https://graph.facebook.com/${id}/picture?width=512&height=512&access_token=6628568379%7Cc1e620fa708a1d5696fb991c1bde5662`,

high Touches account session data

References appState / cookies / access tokens. Stealing these is the classic way Messenger bot accounts get hijacked.

L46

`https://graph.facebook.com/${id}/picture?width=512&height=512&access_token=6628568379%7Cc1e620fa708a1d5696fb991c1bde5662`,

medium Deletes files 3×

Calls fs.rm / unlink / rmdir. Check what path it deletes and whether a user can influence it.

L93fs.unlinkSync(avatar1);

L94fs.unlinkSync(avatar2);

L95fs.unlinkSync(outPath);

low Filesystem access

Reads or writes files on the machine running the bot.

L2const fs = require("fs-extra");

low Network access

Makes HTTP/WebSocket requests. Check where the data goes.

L1const axios = require("axios");

capabilities — what this file can do, regardless of intent

Network Filesystem Shell Env vars Dynamic code Session data Installs packages Process control

dependencies

axios, canvas, fs-extra

checks

Exports a command/module

Handles errors (try/catch or .catch)

Readable, not minified

Has explanatory comments

No deprecated dependencies

Reasonable size (< 200 KB)

raw source — loaded on demand

Loading source…