moideva
High-performance DOM utility and diagnostic bridge for modern web applications.
This report shows the evidence for moideva@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource establishes concrete stealth, persistence, proctoring-evasion, screen/UI capture, and automated AI-assisted cheating behavior. The benign postinstall hook does not mitigate the malicious runtime chain.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Running the moideva command starts a detached watchdog; screen/text capture and AI submission are activated by mouse-edge or keyboard triggers.
Impact
It can bypass proctoring controls and expose captured on-screen content to ChatGPT while concealing the assisting application.
Mechanism
Stealth persistence, foreground-content capture, and automated ChatGPT answer injection.
Attack narrative
When invoked, the launcher detaches a watchdog and disguises an Electron copy as SearchApp.exe. The application creates a hidden, capture-excluded overlay, watches for proctoring software, captures screenshots or UI text from another foreground application, and injects the material into ChatGPT for answers. Its included cookie script can decrypt OpenAI and ChatGPT browser cookies, although the inspected entrypoints do not call that script.
AI rationale
Source establishes concrete stealth, persistence, proctoring-evasion, screen/UI capture, and automated AI-assisted cheating behavior. The benign postinstall hook does not mitigate the malicious runtime chain.
Evidence
package.jsonmain.jsbin/kalamasha-tool.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1bin/uia_extract.execonfig.json
Network endpoints2
chatgpt.com/?model=autochat.openai.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The command-line launcher copies Electron to a Windows-like name, detaches it, and respawns it after termination.
- The Electron window is hidden from capture and actively evades Testpad and core.exe checks.
- User triggers capture screenshots or foreground-window text; the package queues that data for automated AI submission.
- The package injects captured questions and prompts into ChatGPT, then reads answers back into its hidden overlay.
- It ships a PowerShell script that decrypts Chrome-family cookies for OpenAI and ChatGPT domains.
- The package metadata and README use inconsistent names, while source explicitly targets exam/proctor evasion.
Evidence against
- The postinstall hook only attempts to require Electron and does not run the launcher.
- No source evidence shows captured data being sent to an attacker-controlled host.
- The cookie-extraction script is not referenced by the inspected JavaScript entrypoints.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNativeBindings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/kalamasha-tool.jsView file
2L3: const { spawn, execSync } = require('child_process');
L4: const path = require('path');
High
Child Process
Package source references child process execution.
bin/kalamasha-tool.jsView on unpkg · L2Findings
1 Critical8 High4 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/kalamasha-tool.js
HighShellmain.js
HighCross File Remote Execution Contextbin/kalamasha-tool.js
HighRuntime Package Installbin/kalamasha-tool.js
HighKnown Malware Source Similaritymain.js
HighKnown Malware Source Similaritybin/kalamasha-tool.js
HighKnown Malware Source Fingerprint Signaturemain.js
MediumEnvironment Vars
MediumShips Native Binarybin/uia_extract.exe
MediumShips Build Helperbin/chrome_cookies.ps1
Affected versions and remediation
This report applies to moideva@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing moideva@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.