Loading npm security reports…

moidevx@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / moidevx / 1.0.0

moidevx@1.0.0

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Running the CLI launches a hidden, persistent anti-proctor Electron process. User-triggered hotkeys capture foreground exam/UI content and submit it through a logged-in ChatGPT session.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs moidevx CLI/app and uses its capture/solve hotkeys.

Impact

Enables concealed collection of on-screen assessment content and automated AI-assisted cheating; ships an unreferenced browser-session cookie extractor.

Mechanism

Stealth persistence, proctor evasion, foreground capture, and AI-assisted answer submission.

Attack narrative

After an explicit CLI launch, the package disguises a copied Electron binary as SearchApp.exe, detaches it, and respawns it. Its Electron UI is hidden from capture and specifically changes behavior when Testpad's core.exe is detected. Hotkeys capture the active screen or accessibility text, then the app injects that content into ChatGPT. A bundled but unreferenced PowerShell utility decrypts OpenAI/ChatGPT browser cookies.

Rationale

This is a concrete stealth anti-proctor and assessment-capture tool, not a benign diagnostic utility. The harmful runtime chain is user-triggered rather than install-time, but is sufficiently explicit and persistent to warrant blocking.

Evidence

package.jsonbin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1

Network endpoints1

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = eyiouss@4.0.1 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:ZXlpb3Vzcw:4.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

807// STRATEGY: Spawn a NEW electron process on the target desktop L808: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L809:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L807

•matchType = normalized_sha256 matchedPackage = moidev@1.0.0 matchedPath = main.js matchedIdentity = npm:bW9pZGV2:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

main.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 79230485e4373a9d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = moidev@1.0.0 matchedPath = main.js matchedIdentity = npm:bW9pZGV2:1.0.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

main.jsView on unpkg

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 6-46json

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "moidevx": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "profile-picker.html",

19 "config.json",

20 "package.json"

21 ],

22 "scripts": {

23 "start": "node bin/kalamasha-tool.js",

24 "dev": "electron .",

25 "test": "node bin/kalamasha-tool.js",

26 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L26

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 },

28 "dependencies": {

29 "electron": "^25.6.0",

30 "koffi": "^2.15.6",

31 "uiohook-napi": "^1.5.5"

32 },

33 "keywords": [

34 "diagnostic",

35 "verification",

36 "system",

37 "utility",

38 "windows",

39 "enterprise"

40 ],

41 "license": "ISC",

42 "devDependencies": {},

43 "repository": {

44 "type": "git"

45 },

46 "type": "commonjs",

bin/kalamasha-tool.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

main.jsView file

Lines 787-827javascript

787 // New secure desktop detected — spawn child there

788 console.log(`[SCOUT] \u{1F6A8} DESKTOP SWITCH: "${currentDesktopName}" \u{2192} "${inputName}"`);

789 migrateToDesktop(inputName);

790 }

791 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg