moidevl
High-performance DOM utility and diagnostic bridge for modern web applications.
This report shows the evidence for moidevl@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a covert proctoring-evasion and AI-assisted capture tool with persistence and a bundled credential harvester. Its harmless postinstall hook does not mitigate the malicious runtime behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Running the moidevl CLI or its start script.
Impact
Enables concealed exam or proctoring evasion and can expose browser authentication material.
Mechanism
Stealth screen and UI capture, session-token injection, and detached watchdog persistence.
Attack narrative
The executable starts a detached watchdog, disguises its Electron binary, and restarts it after termination. Its Electron application creates capture-excluded, hidden windows, captures screen or UI text, and submits captured questions through authenticated AI web sessions. It also includes code to decrypt and read browser cookies for OpenAI domains. These combined concealment, persistence, capture, and credential-harvesting capabilities are not consistent with the declared DOM diagnostic utility.
AI rationale
This is a covert proctoring-evasion and AI-assisted capture tool with persistence and a bundled credential harvester. Its harmless postinstall hook does not mitigate the malicious runtime behavior.
Evidence
package.jsonmain.jsbin/kalamasha-tool.jsbin/chrome_cookies.ps1bin/stealth_capture.ps1bin/uia_extract.pybin/uia_extract.exe%LOCALAPPDATA%\Microsoft\Windows\Diagnostics\boot.log
Network endpoints4
chatgpt.comchat.openai.comclaude.aigemini.google.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI creates a detached watchdog, disguises Electron as SearchApp.exe, and respawns it after termination.
- The application runs a PowerShell screen capture with execution-policy bypass and queues captured images.
- The Electron window is excluded from screen capture, hidden from Alt-Tab, and actively evades proctoring checks.
- A bundled PowerShell script decrypts browser-protected data while harvesting OpenAI-related cookies.
- The program injects supplied session tokens into ChatGPT, Claude, and Gemini browser sessions.
- The package registers an npm postinstall hook that loads Electron.
Evidence against
- The postinstall hook itself only loads Electron and does not start the launcher.
- The internal ipc.shadxino.internal request is intercepted locally rather than sent to that host.
- No source path was found that invokes the bundled browser-cookie extractor.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNativeBindingsShell
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/kalamasha-tool.jsView file
2L3: const { spawn, execSync } = require('child_process');
L4: const path = require('path');
High
Child Process
Package source references child process execution.
bin/kalamasha-tool.jsView on unpkg · L2Findings
1 Critical8 High4 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/kalamasha-tool.js
HighShellmain.js
HighCross File Remote Execution Contextbin/kalamasha-tool.js
HighRuntime Package Installbin/kalamasha-tool.js
HighKnown Malware Source Similaritymain.js
HighKnown Malware Source Similaritybin/kalamasha-tool.js
HighKnown Malware Source Fingerprint Signaturemain.js
MediumEnvironment Vars
MediumShips Native Binarybin/uia_extract.exe
MediumShips Build Helperbin/chrome_cookies.ps1
Affected versions and remediation
This report applies to moidevl@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing moidevl@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.