
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
End-to-end Encrypted Facebook Messenger
Zuccnet is a fork of https://github.com/mjkaufer/messer, a command-line client for Facebook Messenger. Only difference is, Facebook can't read your messages.
It is known that Facebook scans your messages. If you need to keep using Facebook messenger but care about privacy, Zuccnet might help.
It's pretty simple: you and your friend have Zuccnet installed. Your friend gives you their Zuccnet public key. Then, when you send a message to your friend on Zuccnet, your message is encrypted on your machine before it is sent across Facebook to your friend. Then, your friend's Zuccnet decrypts the message. Facebook never sees the content of your message.
I'm not a security person and there's probably some stuff I've missed - any contributions are very welcome! This is very beta, don't take it too seriously.
| What your friend sees | What Facebook sees |
|---|---|
![]() | ![]() |
nodeversion 12.x required
Install zuccnet
$ npm install -g zuccnet
Run zuccnet
$ zuccnet
Enter your login details (your username and password are not stored)
Get your friend's public key, and assign it to them in Zuccnet
$ public_key "John Smith" /Users/tomquirk/Downloads/johns_id_rsa.pub
Send them a message
$ message "John Smith" Hey John, this is a super secret message
🪄
We don't store your username, password, or any of your interactions on Zuccnet.
The only thing we store is a temporary login token when you first log in. This let's us authenticate you with Facebook without you having to enter your username and password every time. If you want to get rid of it, simply run zuccnet cleanup, or if you're in a Zuccnet session, run the logout command.
No, unforunately not. If you use Zuccnet with a deactivated Facebook account, your account will be reactivated.
Messages from group chats appear like
(My cool friends) John Smith - hey guys!!$$@@
Send a message to a group by using the message command. The name is the name of the group chat! Reply works as normal
messageSends a message to a given user
(message | m) "<user>" <message>
Examples
message "Matthew" hello world!m "Matthew" hello world!When sending a message, Zuccnet picks the closest match to what you type in as user. For this reason, you should probably use last names if you want to avoid accidentally texting someone.
replyReplys to the last message you recevied i.e. Sends a message to the user of the most recently received message.
(reply | r) <message>
Example
r "hey yo this is my reply"Note: this will only work if you have received at least one message through Zuccnet.
contactsLists all of your Facebook friends
contacts
historyDisplays the last n messages in the conversation with a given user. The number of messages to retrieve are optional (default is 5).
(history | h) "<user>" [<n>]
Examples
history "Matthew" 10h "Matthew"recentDisplays the n most recent conversations. The number of threads is optional (default is 5).
The --history option will display the 5 most recent messages in each thread.
recent [<n>] [--history]
Examples
recentrecent 10recent --historyclearClears the number of unread messages in the window title. Since we cannot listen on focus events, it has to be done manually.
(clear | c)
logoutLogs you out
logout
muteMutes a thread. If no seconds are specified, the thread is muted indefinetely.
mute "<thread-name>" [seconds]
unmuteUnmutes a thread
unmute "<thread-name>"
settingsConfigure your user settings on Zuccnet
settings (set | get | list) [<key>=<value>]
Examples
settings listsettings get SHOW_READsettings set SHOW_READ=trueFor supported settings, see section below
SHOW_READ
clear commandLocking on to a user or group allows you to send messages without having to specify the message command; just type away!
lock "Tom Q"
To unlock, simply run:
--unlock
When in this mode, any messages sent or recieved in the thread will be deleted for you (note, they won't be deleted for everyone).
lock "Tom Q" --secret
Zuccnet can be run in non-interactive mode with command line arguments to execute a single command.
zuccnet --command='<command>'
Login will be prompted if this is the first time logging in.
Examples
zuccnet --command='m "John Smith" Hey, John'zuccnet --command='r Hey, John'If ever you want to clean up any old Zuccnet sessions and start from scratch, run:
$ zuccnet cleanup
Want to add a new command, fix a bug or improve Zuccnet in another way? Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us.
This project is licensed under the ISC License - see the LICENSE file for details
FAQs
End-to-end Encrypted Facebook Messenger
The npm package zuccnet receives a total of 5 weekly downloads. As such, zuccnet popularity was classified as not popular.
We found that zuccnet demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.