registry / bmcat / 2.0.9

bmcat@2.0.9

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

When the user runs the command, it installs a disguised, detached watchdog and a hidden overlay. The overlay captures foreground content, uses AI services to solve it, and actively evades proctoring or capture controls.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running the bmcat command activates the detached launcher and Electron application; screen edges and global hotkeys activate capture and submission.

Impact

Enables concealed exam or assessment cheating, persistent user-space execution, and exposure or misuse of AI session credentials.

Mechanism

Stealth proctoring evasion, foreground capture, and AI-session automation.

Attack narrative

A user who runs the package starts a detached launcher that copies Electron under a plausible Windows process name and respawns it. The application makes a hidden overlay resistant to screenshots and proctor interference, captures the active window through UI automation or GDI, and sends captured questions to logged-in AI services. It also ships code to decrypt browser cookies and code to inject AI session tokens. This is a concealed cheating and credential-misuse tool, not the DOM diagnostic utility claimed in its metadata.

Rationale

Source inspection confirms a concrete stealth, persistence, capture, and AI-assisted cheating workflow. Its credential-handling code and bundled credential material compound the risk, so publication should be blocked.

Evidence

package.jsonbin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1profile-picker.htmlconfig.jsonbin/uia_extract.exe%LOCALAPPDATA%\Microsoft\Windows\Diagnostics\boot.log%LOCALAPPDATA%\Microsoft\Windows\Diagnostics\.kill_watchdog

Network endpoints5

chatgpt.com/?model=autochat.openai.comclaude.aigemini.google.com/appipc.shadxino.internal/login_post

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The command launcher creates a detached watchdog, disguises an Electron copy as SearchApp.exe, and respawns it after termination.
The main process hides its overlay from capture and repeatedly counters Testpad/proctor windows.
Runtime hotkeys and screen-edge actions capture foreground text or images, then submit them to AI services.
The package includes a browser-cookie decryption utility for OpenAI-related domains and code that injects session tokens into AI-service cookies.
The bundled configuration contains credential material; it should not have been published.

Evidence against

The postinstall hook only attempts to require Electron and does not launch the application.
The inspected source does not show the cookie extractor being invoked by the application.
No separate attacker-controlled exfiltration host was identified; the observed external destinations are AI services selected by the package.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 95.4 KB of source, external domains: chat.openai.com, chatgpt.com, claude.ai, gemini.google.com, google.com, ipc.shadxino.internal

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = moidevu@1.0.0 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:bW9pZGV2dQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

807// STRATEGY: Spawn a NEW electron process on the target desktop L808: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L809:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L807

•matchType = normalized_sha256 matchedPackage = moidevu@1.0.0 matchedPath = main.js matchedIdentity = npm:bW9pZGV2dQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

main.jsView on unpkg

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11705 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

807// STRATEGY: Spawn a NEW electron process on the target desktop L808: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L809:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L807

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

main.jsView on unpkg

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11705 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Findings

1 Critical7 High4 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/kalamasha-tool.js

HighShellmain.js

HighCross File Remote Execution Contextbin/kalamasha-tool.js

HighRuntime Package Installbin/kalamasha-tool.js

HighKnown Malware Source Similaritymain.js

HighKnown Malware Source Similaritybin/kalamasha-tool.js

MediumEnvironment Vars

MediumShips Native Binarybin/uia_extract.exe

MediumShips Build Helperbin/chrome_cookies.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings