registry / moudeva / 1.0.0

moudeva@1.0.0

OSV Malicious Advisory

imported 17d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16442 confirms this npm version as malicious. The package's main.js references child_process at multiple locations (lines 19, 883, 961) alongside HTTP POST calls (lines 365, 369) to a hardcoded endpoint https://ipc.shadxino.internal (referenced at lines 359 and 453). The.internal TLD is not a publicly registrable domain and is consistent with an attacker-controlled or otherwise non-legitimate destination that resolves only in a controlled network context...

Advisory

MAL-2026-16442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in moudeva (npm)

Details

The package's main.js references child_process at multiple locations (lines 19, 883, 961) alongside HTTP POST calls (lines 365, 369) to a hardcoded endpoint https://ipc.shadxino.internal (referenced at lines 359 and 453). The.internal TLD is not a publicly registrable domain and is consistent with an attacker-controlled or otherwise non-legitimate destination that resolves only in a controlled network context. The co-location of a shell/process-execution primitive with an unconditional POST to a fixed non-standard host inside a single module matches the shape of installer-side command execution and data exfiltration.

Decision reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 102 KB of source, external domains: chat.openai.com, chatgpt.com, claude.ai, gemini.google.com, google.com, ipc.shadxino.internal

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = moidevl@1.0.0 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:bW9pZGV2bA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

809// STRATEGY: Spawn a NEW electron process on the target desktop L810: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L811:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L809

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

Findings

1 Critical6 High4 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/kalamasha-tool.js

HighShellmain.js

HighCross File Remote Execution Contextbin/kalamasha-tool.js

HighRuntime Package Installbin/kalamasha-tool.js

HighKnown Malware Source Similaritybin/kalamasha-tool.js

MediumEnvironment Vars

MediumShips Native Binarybin/uia_extract.exe

MediumShips Build Helperbin/chrome_cookies.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to moudeva@1.0.0.

See version security history for other recorded verdicts.

Avoid installing moudeva@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 03:00:06.235Z (UTC).

Source advisory published: 2026-09-23 02:44:39.000Z (UTC).