registry / exiouss / 2.0.20

exiouss@2.0.20

⚠ Under review

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 97.5 KB of source, external domains: chat.openai.com, chatgpt.com, claude.ai, gemini.google.com, google.com, ipc.shadxino.internal

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = shadxino@2.0.9 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:c2hhZHhpbm8:2.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

807// STRATEGY: Spawn a NEW electron process on the target desktop L808: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L809:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L807

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

Findings

1 Critical6 High4 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/kalamasha-tool.js

HighShellmain.js

HighCross File Remote Execution Contextbin/kalamasha-tool.js

HighRuntime Package Installbin/kalamasha-tool.js

HighKnown Malware Source Similaritybin/kalamasha-tool.js

MediumEnvironment Vars

MediumShips Native Binarybin/uia_extract.exe

MediumShips Build Helperbin/chrome_cookies.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to exiouss@2.0.20.

See version security history for other recorded verdicts.

Review the evidence and your use of exiouss@2.0.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-11 21:24:19.771Z (UTC).