Loading npm security reports…

moideva@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / moideva / 1.0.0

moideva@1.0.0

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

This is a stealth examination-cheating tool. It captures the screen or foreground application, sends questions to ChatGPT, and displays answers in a concealed overlay that attempts to evade proctoring tools.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the moideva command starts a detached watchdog; screen/text capture and AI submission are activated by mouse-edge or keyboard triggers.

Impact

It can bypass proctoring controls and expose captured on-screen content to ChatGPT while concealing the assisting application.

Mechanism

Stealth persistence, foreground-content capture, and automated ChatGPT answer injection.

Attack narrative

When invoked, the launcher detaches a watchdog and disguises an Electron copy as SearchApp.exe. The application creates a hidden, capture-excluded overlay, watches for proctoring software, captures screenshots or UI text from another foreground application, and injects the material into ChatGPT for answers. Its included cookie script can decrypt OpenAI and ChatGPT browser cookies, although the inspected entrypoints do not call that script.

Rationale

Source establishes concrete stealth, persistence, proctoring-evasion, screen/UI capture, and automated AI-assisted cheating behavior. The benign postinstall hook does not mitigate the malicious runtime chain.

Evidence

package.jsonmain.jsbin/kalamasha-tool.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1bin/uia_extract.exe

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = moidevy@1.0.0 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:bW9pZGV2eQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

807// STRATEGY: Spawn a NEW electron process on the target desktop L808: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L809:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L807

•matchType = normalized_sha256 matchedPackage = moidevy@1.0.0 matchedPath = main.js matchedIdentity = npm:bW9pZGV2eQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

main.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 79230485e4373a9d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = moidevy@1.0.0 matchedPath = main.js matchedIdentity = npm:bW9pZGV2eQ:1.0.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

main.jsView on unpkg

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = moidevy@1.0.0 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:bW9pZGV2eQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

807// STRATEGY: Spawn a NEW electron process on the target desktop L808: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L809:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L807

•matchType = normalized_sha256 matchedPackage = moidevy@1.0.0 matchedPath = main.js matchedIdentity = npm:bW9pZGV2eQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

main.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 79230485e4373a9d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = moidevy@1.0.0 matchedPath = main.js matchedIdentity = npm:bW9pZGV2eQ:1.0.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

main.jsView on unpkg

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg