registry / Persistence / moidevx
moidevx
High-performance DOM utility and diagnostic bridge for modern web applications.
This report shows the evidence for moidevx@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete stealth anti-proctor and assessment-capture tool, not a benign diagnostic utility. The harmful runtime chain is user-triggered rather than install-time, but is sufficiently explicit and persistent to warrant blocking.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
User runs moidevx CLI/app and uses its capture/solve hotkeys.
Impact
Enables concealed collection of on-screen assessment content and automated AI-assisted cheating; ships an unreferenced browser-session cookie extractor.
Mechanism
Stealth persistence, proctor evasion, foreground capture, and AI-assisted answer submission.
Attack narrative
After an explicit CLI launch, the package disguises a copied Electron binary as SearchApp.exe, detaches it, and respawns it. Its Electron UI is hidden from capture and specifically changes behavior when Testpad's core.exe is detected. Hotkeys capture the active screen or accessibility text, then the app injects that content into ChatGPT. A bundled but unreferenced PowerShell utility decrypts OpenAI/ChatGPT browser cookies.
AI rationale
This is a concrete stealth anti-proctor and assessment-capture tool, not a benign diagnostic utility. The harmful runtime chain is user-triggered rather than install-time, but is sufficiently explicit and persistent to warrant blocking.
Evidence
package.jsonbin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1
Network endpoints1
chatgpt.com/?model=auto
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- CLI clones Electron as SearchApp.exe and runs a detached respawning watchdog.
- Main process explicitly hides its window and evades Testpad core.exe checks.
- Hotkeys capture the foreground window/UI text, queue it, then inject it into ChatGPT.
- Bundled PowerShell decrypts and outputs OpenAI/ChatGPT browser cookies.
- The install hook only tests whether Electron can be required; malicious actions occur when the CLI/app is run.
Evidence against
- No package-source reference invokes bin/chrome_cookies.ps1.
- The internal IPC POST is intercepted and cancelled locally, not sent to its nominal host.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNativeBindingsShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/kalamasha-tool.jsView file
2L3: const { spawn, execSync } = require('child_process');
L4: const path = require('path');
High
Child Process
Package source references child process execution.
bin/kalamasha-tool.jsView on unpkg · L2Findings
1 Critical8 High4 Medium4 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/kalamasha-tool.js
HighShellmain.js
HighCross File Remote Execution Contextbin/kalamasha-tool.js
HighRuntime Package Installbin/kalamasha-tool.js
HighKnown Malware Source Similaritymain.js
HighKnown Malware Source Similaritybin/kalamasha-tool.js
HighKnown Malware Source Fingerprint Signaturemain.js
MediumEnvironment Vars
MediumShips Native Binarybin/uia_extract.exe
MediumShips Build Helperbin/chrome_cookies.ps1
Affected versions and remediation
This report applies to moidevx@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing moidevx@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.