Loading npm security reports…

moidev@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / moidev / 1.0.0

moidev@1.0.0

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On explicit CLI execution, the package installs a disguised detached watchdog, creates a hidden anti-proctor overlay, and captures foreground content for ChatGPT. A bundled credential-decryption script increases credential-theft capability, though it is not referenced by the main runtime path.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the moidev CLI; capture and upload are activated by global hotkey combinations.

Impact

Concealed collection and external transfer of foreground content, plus a bundled browser-session credential extractor.

Mechanism

stealth persistence, screen/UI capture, and automated AI submission

Attack narrative

After a user runs the CLI, it detaches and respawns an Electron process under the deceptive SearchApp.exe name. The app creates an overlay designed to avoid capture and specifically changes its capture-protection behavior when a proctor scanner is detected. Global hotkeys capture foreground screenshots or UI text, then inject the collected content into a hidden ChatGPT session. Separately, the package includes a PowerShell component that decrypts browser cookies for OpenAI domains.

Rationale

This is a concrete stealth, persistence, capture, and external-submission chain, not a diagnostic utility. The benign postinstall hook does not mitigate the malicious user-executed behavior.

Evidence

package.jsonbin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1bin/uia_extract.execonfig.json

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = shadxino@2.0.9 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:c2hhZHhpbm8:2.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

807// STRATEGY: Spawn a NEW electron process on the target desktop L808: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L809:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L807

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 6-46json

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "moidev": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "profile-picker.html",

19 "config.json",

20 "package.json"

21 ],

22 "scripts": {

23 "start": "node bin/kalamasha-tool.js",

24 "dev": "electron .",

25 "test": "node bin/kalamasha-tool.js",

26 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L26

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "electron": "^25.6.0",

30 "koffi": "^2.15.6",

31 "uiohook-napi": "^1.5.5"

32 },

33 "keywords": [

34 "diagnostic",

35 "verification",

36 "system",

37 "utility",

38 "windows",

39 "enterprise"

40 ],

41 "license": "ISC",

42 "devDependencies": {},

43 "repository": {

44 "type": "git"

45 },

46 "type": "commonjs",

bin/kalamasha-tool.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

main.jsView file

Lines 787-827javascript

787 // New secure desktop detected — spawn child there

788 console.log(`[SCOUT] \u{1F6A8} DESKTOP SWITCH: "${currentDesktopName}" \u{2192} "${inputName}"`);

789 migrateToDesktop(inputName);

790 }

791 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg