registry / Malware / eyiouss

eyiouss

High-performance DOM utility and diagnostic bridge for modern web applications.

This report shows the evidence for eyiouss@4.0.1. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source establishes a concrete stealth, persistence, capture, and remote-submission chain aimed at defeating proctoring. The inert cookie extractor further reinforces malicious intent, though it is not needed for the verdict.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the eyiouss CLI.

Impact

Unauthorized disclosure of on-screen assessment content and evasion of monitoring controls.

Mechanism

Stealth proctoring evasion, screen/UI harvesting, and automated ChatGPT submission.

Attack narrative

The explicit CLI starts a detached watchdog under a deceptive executable name, restores itself after termination, and uses a hidden overlay designed to evade Testpad/core.exe. Runtime triggers extract foreground UI text or screenshots and inject captured questions into a ChatGPT session. A bundled but unreferenced script can decrypt browser cookies for OpenAI domains, adding credential-theft capability.

AI rationale

Evidence

package.jsonbin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1bin/uia_extract.exe

Network endpoints2

chatgpt.com/?model=autochat.openai.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

CLI creates a disguised SearchApp.exe and detached respawning watchdog.
Runtime hides its overlay from capture, Alt-Tab, taskbar, and Testpad/core.exe checks.
It captures foreground-window text and screenshots, then submits them to ChatGPT.
Package includes a Chrome/Edge/Brave OpenAI-session cookie decryptor.

Evidence against

postinstall only attempts to require Electron; it does not launch the application.
The cookie extractor is not referenced by the inspected JavaScript entrypoints.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 100 KB of source, external domains: chat.openai.com, chatgpt.com, claude.ai, gemini.google.com, google.com, ipc.shadxino.internal

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = shadxino@2.0.9 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:c2hhZHhpbm8:2.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

825// STRATEGY: Spawn a NEW electron process on the target desktop L826: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L827:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L825

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

Findings

1 Critical6 High4 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/kalamasha-tool.js

HighShellmain.js

HighCross File Remote Execution Contextbin/kalamasha-tool.js

HighRuntime Package Installbin/kalamasha-tool.js

HighKnown Malware Source Similaritybin/kalamasha-tool.js

MediumEnvironment Vars

MediumShips Native Binarybin/uia_extract.exe

MediumShips Build Helperbin/chrome_cookies.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to eyiouss@4.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing eyiouss@4.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-04 06:45:10.950Z (UTC).

Source advisory published: 2026-09-02 06:01:15.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.0.1-securitylatestClean—AllowPublishedSep 2, 2026, 6:00 AM 4.0.1shownMaliciousMalwareBlockPublishedAug 16, 2026, 2:02 PM 3.0.22MaliciousMalwareBlockPublishedAug 13, 2026, 4:30 AM 3.0.21MaliciousMalwareBlockPublishedAug 13, 2026, 4:24 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages