registry / Data exfiltration / hehehe
hehehe
High-performance DOM utility and diagnostic bridge for modern web applications.
This report shows the evidence for hehehe@2.0.2. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource establishes a concrete surveillance-and-exfiltration chain paired with stealth persistence and proctoring evasion. The benign postinstall hook does not mitigate the malicious runtime behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
User runs `hehehe`/`bin/kalamasha-tool.js` or starts the Electron app.
Impact
Unauthorized disclosure of foreground content and deliberate circumvention of exam/proctoring controls; includes dormant browser-session cookie extraction capability.
Mechanism
Stealth screen/UI capture, remote AI submission, anti-proctor evasion, and watchdog persistence.
Attack narrative
On explicit runtime launch, the package creates a disguised, detached Electron watchdog that persists through termination attempts. Its hotkey workflow captures the foreground window or extracts its UI text, then sends that content to Gemini or a configurable GAS proxy for answers. The application hides its UI, alters browser fingerprint/visibility signals, and contains explicit anti-proctor/Testpad evasion. A separate included PowerShell payload decrypts browser cookies for OpenAI/ChatGPT domains, although this version does not invoke it.
AI rationale
Source establishes a concrete surveillance-and-exfiltration chain paired with stealth persistence and proctoring evasion. The benign postinstall hook does not mitigate the malicious runtime behavior.
Evidence
package.jsonmain.jsbin/kalamasha-tool.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1bin/uia_extract.execonfig.json
Network endpoints3
gemini.google.com/appchatgpt.comchat.openai.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `main.js` captures the foreground window via `bin/stealth_capture.ps1` and queues its image data.
- `main.js` extracts foreground UI text through `bin/uia_extract.py`/`uia_extract.exe`.
- `main.js` sends captured text/images to configurable `GAS_URL` or injects them into Gemini.
- `main.js` implements anti-proctor/Testpad evasion, hidden overlay behavior, and browser fingerprint bypasses.
- `bin/kalamasha-tool.js` disguises Electron as `SearchFilterHost.exe`, detaches it, and respawns it after termination.
- `bin/chrome_cookies.ps1` contains a DPAPI/AES routine to extract OpenAI/ChatGPT browser cookies.
Evidence against
- `package.json` postinstall only attempts `require('electron')` and does not invoke the malicious launcher.
- No source reference invokes `bin/chrome_cookies.ps1`; the credential-stealing script is presently dormant.
- No hard-coded third-party exfiltration host appears; the direct proxy endpoint is user-configured.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/kalamasha-tool.jsView file
2L3: const { spawn, execSync } = require('child_process');
L4: const path = require('path');
High
Child Process
Package source references child process execution.
bin/kalamasha-tool.jsView on unpkg · L2Findings
1 Critical6 High5 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/kalamasha-tool.js
HighShellmain.js
HighCross File Remote Execution Contextbin/kalamasha-tool.js
HighRuntime Package Installbin/kalamasha-tool.js
HighKnown Malware Source Similaritybin/kalamasha-tool.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarybin/uia_extract.exe
MediumShips Build Helperbin/chrome_cookies.ps1
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to hehehe@2.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing hehehe@2.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.