Loading npm security reports…

eyiouss@4.0.1: Malicious npm security report (Block) | LPM Firewall

registry / eyiouss / 4.0.1

eyiouss@4.0.1

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

When the installed CLI is run, it establishes a hidden, respawning Electron overlay that evades proctoring checks. It captures another foreground application's text/screenshots and sends questions to ChatGPT.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the eyiouss CLI.

Impact

Unauthorized disclosure of on-screen assessment content and evasion of monitoring controls.

Mechanism

Stealth proctoring evasion, screen/UI harvesting, and automated ChatGPT submission.

Attack narrative

The explicit CLI starts a detached watchdog under a deceptive executable name, restores itself after termination, and uses a hidden overlay designed to evade Testpad/core.exe. Runtime triggers extract foreground UI text or screenshots and inject captured questions into a ChatGPT session. A bundled but unreferenced script can decrypt browser cookies for OpenAI domains, adding credential-theft capability.

Rationale

Source establishes a concrete stealth, persistence, capture, and remote-submission chain aimed at defeating proctoring. The inert cookie extractor further reinforces malicious intent, though it is not needed for the verdict.

Evidence

package.jsonbin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1bin/uia_extract.exe

Network endpoints2

chatgpt.com/?model=auto

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = shadxino@2.0.9 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:c2hhZHhpbm8:2.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

825// STRATEGY: Spawn a NEW electron process on the target desktop L826: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L827:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L825

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 6-46json

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "eyiouss": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "profile-picker.html",

19 "config.json",

20 "package.json"

21 ],

22 "scripts": {

23 "start": "node bin/kalamasha-tool.js",

24 "dev": "electron .",

25 "test": "node bin/kalamasha-tool.js",

26 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L26

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "electron": "^25.6.0",

30 "koffi": "^2.15.6",

31 "uiohook-napi": "^1.5.5"

32 },

33 "keywords": [

34 "diagnostic",

35 "verification",

36 "system",

37 "utility",

38 "windows",

39 "enterprise"

40 ],

41 "license": "ISC",

42 "devDependencies": {},

43 "repository": {

44 "type": "git"

45 },

46 "type": "commonjs",

bin/kalamasha-tool.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

main.jsView file

Lines 805-845javascript

805 // New secure desktop detected — spawn child there

806 console.log(`[SCOUT] \u{1F6A8} DESKTOP SWITCH: "${currentDesktopName}" \u{2192} "${inputName}"`);

807 migrateToDesktop(inputName);

808 }

809 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg