Cmdsuspend
No description
5
views
0
likes
5
installs
analysis — static scan, nothing executed
0
grade F
Dangerous — do not install without a full manual review
Security
84
Privacy
19
Quality
100
Maintenance
82
Community
20
critical
Possible credential exfiltration
The file reads session data or secrets and also talks to the network. Verify nothing sensitive is being sent out.
L56
const profilePicUrl = "https://graph.facebook.com/" + targetID + "/picture?height=720&width=720&access_token=6628568379%7Cc1e620fa708a1d5696fb991c1bde5662";
high
Touches account session data
References appState / cookies / access tokens. Stealing these is the classic way Messenger bot accounts get hijacked.
L56
const profilePicUrl = "https://graph.facebook.com/" + targetID + "/picture?height=720&width=720&access_token=6628568379%7Cc1e620fa708a1d5696fb991c1bde5662";
medium
Deletes files
Calls fs.rm / unlink / rmdir. Check what path it deletes and whether a user can influence it.
L156
[avtPath, coverPath, outputPath].forEach(p => { try { fs.unlinkSync(p); } catch (_) {} });
low
Hard-coded IP address
4×
Talks to a raw IP address instead of a named host — harder to audit and easy to redirect.
L226
const UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36";L250
const mHeaders = { ...headers, "user-agent": "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36" };L263
"user-agent": "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 Chrome/120.0.0.0 Mobile Safari/537.36",L346
"user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36",
low
Filesystem access
Reads or writes files on the machine running the bot.
L2
const fs = require("fs-extra");
low
Network access
Makes HTTP/WebSocket requests. Check where the data goes.
L3
const axios = require("axios");capabilities — what this file can do, regardless of intent
Network
Filesystem
Shell
Env vars
Dynamic code
Session data
Installs packages
Process control
dependencies
axios, canvas, cheerio, fs-extra
checks
Exports a command/module
Handles errors (try/catch or .catch)
Readable, not minified
Has explanatory comments
No deprecated dependencies
Reasonable size (< 200 KB)
raw source — loaded on demand
Loading source…