Loading npm security reports…

exiouss@5.0.1: Malicious npm security report (Block) | LPM Firewall

registry / exiouss / 5.0.1

exiouss@5.0.1

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Running the package bin disguises an Electron app as Windows Search, keeps a watchdog that relaunches it, and hides an overlay from capture and the taskbar. A bundled script decrypts browser cookies for OpenAI hosts, and a PowerShell helper copies the foreground window.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User or npm start/test execution of bin/kalamasha-tool.js, which spawns main.js. Cookie extraction runs when bin/chrome_cookies.ps1 is executed.

Impact

A concealed persistent process can evade proctoring and screen sharing, capture on-screen content, and recover browser session cookies for ChatGPT and OpenAI hosts.

Mechanism

The launcher copies electron.exe to SearchApp.exe and respawns it. main.js uses user32 display affinity and tool-window styles, a global input hook, and stealth_capture.ps1. chrome_cookies.ps1 copies browser cookie databases and decrypts them with DPAPI.

Attack narrative

The published bin is a disguised exam-cheat implant, not a DOM utility. On start it copies Electron to SearchApp.exe, detaches, and restarts if killed. The Electron app hides an overlay from screenshots and the taskbar, hooks input, and grabs the foreground window through PowerShell. A bundled script decrypts Chrome, Edge, and Brave cookies for OpenAI and ChatGPT and prints them as JSON. Install does not auto-run this, but the shipped runtime is built to stay hidden and take session material and screen content.

AI rationale

The launcher, overlay, screen grabber, and browser-cookie decryptor are concrete stealth and credential-theft behavior under a false package description. Install does not auto-start them, but the shipped bin and scripts are an active implant once the documented start command runs.

Evidence

bin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1

Source & flagged code

9 flagged

package.jsonView file

Lines 6-46json

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "exiouss": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "profile-picker.html",

19 "config.json",

20 "package.json"

21 ],

22 "scripts": {

23 "start": "node bin/kalamasha-tool.js",

24 "dev": "electron .",

25 "test": "node bin/kalamasha-tool.js",

26 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L26

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "electron": "^25.6.0",

30 "koffi": "^2.15.6",

31 "uiohook-napi": "^1.5.5"

32 },

33 "keywords": [

34 "diagnostic",

35 "verification",

36 "system",

37 "utility",

38 "windows",

39 "enterprise"

40 ],

41 "license": "ISC",

42 "devDependencies": {},

43 "repository": {

44 "type": "git"

45 },

46 "type": "commonjs",

bin/kalamasha-tool.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

main.jsView file

Lines 805-845javascript

805 // New secure desktop detected — spawn child there

806 console.log(`[SCOUT] \u{1F6A8} DESKTOP SWITCH: "${currentDesktopName}" \u{2192} "${inputName}"`);

807 migrateToDesktop(inputName);

808 }

809 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = sysverify@2.0.10 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:c3lzdmVyaWZ5:2.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

825// STRATEGY: Spawn a NEW electron process on the target desktop L826: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L827:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L825

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 6-46json

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "exiouss": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "profile-picker.html",

19 "config.json",

20 "package.json"

21 ],

22 "scripts": {

23 "start": "node bin/kalamasha-tool.js",

24 "dev": "electron .",

25 "test": "node bin/kalamasha-tool.js",

26 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L26

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "electron": "^25.6.0",

30 "koffi": "^2.15.6",

31 "uiohook-napi": "^1.5.5"

32 },

33 "keywords": [

34 "diagnostic",

35 "verification",

36 "system",

37 "utility",

38 "windows",

39 "enterprise"

40 ],

41 "license": "ISC",

42 "devDependencies": {},

43 "repository": {

44 "type": "git"

45 },

46 "type": "commonjs",

bin/kalamasha-tool.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

main.jsView file

Lines 805-845javascript

805 // New secure desktop detected — spawn child there

806 console.log(`[SCOUT] \u{1F6A8} DESKTOP SWITCH: "${currentDesktopName}" \u{2192} "${inputName}"`);

807 migrateToDesktop(inputName);

808 }

809 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

exiouss@5.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code