registry / hehehe / 2.0.2

hehehe@2.0.2

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Running the CLI starts a detached, self-respawning Electron watchdog disguised as a Windows process. The app covertly captures visible test content, sends it to AI services, and presents or types answers while evading proctoring and capture controls.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit execution of the `hehehe` CLI or `node bin/kalamasha-tool.js`

Impact

Enables concealed examination cheating, resists termination, and includes an inert credential-harvesting helper.

Mechanism

Stealth proctor-evasion watchdog with screen/UI capture and AI-assisted answer injection

Attack narrative

The explicit CLI launcher detaches into a watchdog, disguises Electron as `SearchFilterHost.exe`, and repeatedly respawns it after termination. The Electron payload uses global hooks, hidden/capture-excluded windows, UI automation, and screenshot capture to collect test content. It sends prompts to Gemini or an operator-configured GAS endpoint, polls/injects answers, and supports synthetic typing. The source repeatedly identifies TestPad/proctor avoidance as its objective. A separate packaged PowerShell helper can decrypt ChatGPT/OpenAI browser cookies, but was not found on the runtime call path.

Rationale

Source inspection confirms a concrete stealth-and-persistence workflow designed to bypass proctoring and automate AI-assisted answers. The harmless postinstall hook does not mitigate the malicious runtime behavior exposed through the package CLI.

Evidence

package.jsonmain.jsbin/kalamasha-tool.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1config.jsonbin/uia_extract.exe

Network endpoints5

gemini.google.com/app*://*.openai.com/**://*.chatgpt.com/**://*.google.com/**://*.deepseek.com/*

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`bin/kalamasha-tool.js` detaches a watchdog and respawns its child after termination.
`bin/kalamasha-tool.js` copies Electron as `SearchFilterHost.exe` to evade Electron-targeted killing.
`main.js` hides an always-on-top capture-excluded overlay and explicitly targets proctor evasion.
`main.js` captures screen/UI text, submits prompts to Gemini or configured GAS, and injects returned answers.
`main.js` spoofs browser identity and disables common automation/visibility signals.
`bin/chrome_cookies.ps1` decrypts OpenAI/ChatGPT browser cookies, though no source reference invokes it.

Evidence against

`package.json` postinstall only attempts to require Electron and does not invoke the launcher.
No hard-coded third-party exfiltration URL was found; GAS routing requires user-supplied `gasUrl`.
`bin/chrome_cookies.ps1` is not referenced by the inspected JavaScript source.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 91.5 KB of source, external domains: chat.openai.com, chatgpt.com, gemini.google.com

Source & flagged code

8 flagged

package.jsonView file

Lines 5-44json

5 "description": "High-performance DOM utility and diagnostic bridge for modern web applications.",

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "hehehe": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "config.json",

19 "package.json"

20 ],

21 "scripts": {

22 "start": "node bin/kalamasha-tool.js",

23 "dev": "electron .",

24 "test": "node bin/kalamasha-tool.js",

25 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L25

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 },

27 "dependencies": {

28 "electron": "^25.6.0",

29 "koffi": "^2.15.6",

30 "uiohook-napi": "^1.5.5"

31 },

32 "keywords": [

33 "diagnostic",

34 "verification",

35 "system",

36 "utility",

37 "windows",

38 "enterprise"

39 ],

40 "license": "ISC",

41 "devDependencies": {},

42 "type": "commonjs"

43}

bin/kalamasha-tool.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

5const fs

main.jsView file

Lines 597-637javascript

597 wakeUpParent();

598 }

599 currentDesktopName = 'Default';

600 } else {

601 // Secure desktop detected. Migrate if it's new, even if we had a child on the old one.

602 migrateToDesktop(inputName);

603 }

604 }

605 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27459953 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

67try { L68: execSync('npm install ' + missing.join(' ') + ' --no-save', { L69: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L67

main.jsView file

617// STRATEGY: Spawn a NEW electron process on the target desktop L618: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L619:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L617

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27459953 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Findings

1 Critical5 High5 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/kalamasha-tool.js

HighShellmain.js

HighCross File Remote Execution Contextbin/kalamasha-tool.js

HighRuntime Package Installbin/kalamasha-tool.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/uia_extract.exe

MediumShips Build Helperbin/chrome_cookies.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 5-44json

5 "description": "High-performance DOM utility and diagnostic bridge for modern web applications.",

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "hehehe": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "config.json",

19 "package.json"

20 ],

21 "scripts": {

22 "start": "node bin/kalamasha-tool.js",

23 "dev": "electron .",

24 "test": "node bin/kalamasha-tool.js",

25 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L25

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 },

27 "dependencies": {

28 "electron": "^25.6.0",

29 "koffi": "^2.15.6",

30 "uiohook-napi": "^1.5.5"

31 },

32 "keywords": [

33 "diagnostic",

34 "verification",

35 "system",

36 "utility",

37 "windows",

38 "enterprise"

39 ],

40 "license": "ISC",

41 "devDependencies": {},

42 "type": "commonjs"

43}

bin/kalamasha-tool.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

5const fs

main.jsView file

Lines 597-637javascript

597 wakeUpParent();

598 }

599 currentDesktopName = 'Default';

600 } else {

601 // Secure desktop detected. Migrate if it's new, even if we had a child on the old one.

602 migrateToDesktop(inputName);

603 }

604 }

605 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27459953 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg