Loading npm security reports…

shadxino@2.0.9: Malicious npm security report (Block) | LPM Firewall

registry / shadxino / 2.0.9

shadxino@2.0.9

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Running the CLI launches a concealed, persistent Electron watchdog. It captures foreground test content and submits it to ChatGPT while actively evading proctoring and screen-capture checks.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `shadxino` (directly or through its CLI bin entrypoint).

Impact

Covert extraction of on-screen assessment content, automated answer generation, and resistance to user or proctor termination.

Mechanism

stealth UI capture, ChatGPT automation, proctor evasion, and watchdog persistence

Attack narrative

The CLI detaches a watchdog, copies Electron to `SearchApp.exe`, and respawns it when killed. The Electron app captures foreground-window pixels or accessibility text, injects the captured content into a concealed ChatGPT window, and reads answers back into an overlay. Native window APIs hide the overlay from capture and include logic specifically intended to evade `core.exe` scans. A bundled cookie-decryption helper adds credential-harvesting capability, although no inspected source path invokes it.

Rationale

Source establishes a concrete covert assessment-cheating and proctor-evasion workflow with persistence, not a benign DOM utility. The unused browser-cookie helper further raises risk, while the install hook itself is not the attack trigger.

Evidence

package.jsonREADME.mdmain.jsbin/kalamasha-tool.jsbin/stealth_capture.ps1bin/uia_extract.pybin/chrome_cookies.ps1bin/uia_extract.execonfig.json

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

40package = shadxino; repositoryIdentity = npm; dependency = electron L40: try { L41: const electronPath = require('electron'); L42: if (typeof electronPath === 'string' && fs.existsSync(electronPath)) return electronPath;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/kalamasha-tool.jsView on unpkg · L40

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

main.jsView file

603// STRATEGY: Spawn a NEW electron process on the target desktop L604: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L605:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L603

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 5-45json

5 "description": "High-performance DOM utility and diagnostic bridge for modern web applications.",

6 "author": "Exious Core team",

7 "main": "main.js",

8 "bin": {

9 "shadxino": "bin/kalamasha-tool.js"

10 },

11 "files": [

12 "main.js",

13 "renderer.js",

14 "index.html",

15 "styles.css",

16 "bin/",

17 "public/",

18 "config.json",

19 "package.json"

20 ],

21 "scripts": {

22 "start": "node bin/kalamasha-tool.js",

23 "dev": "electron .",

24 "test": "node bin/kalamasha-tool.js",

25 "postinstall": "node -e \"try{require('electron')}catch(e){console.log('Electron will download on first run.')}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L25

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 },

27 "dependencies": {

28 "electron": "^25.6.0",

29 "koffi": "^2.15.6",

30 "uiohook-napi": "^1.5.5"

31 },

32 "keywords": [

33 "diagnostic",

34 "verification",

35 "system",

36 "utility",

37 "windows",

38 "enterprise"

39 ],

40 "license": "ISC",

41 "devDependencies": {},

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/Sagararora90/npm.git"

45 },

bin/kalamasha-tool.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

main.jsView file

Lines 583-623javascript

583 // New secure desktop detected — spawn child there

584 console.log(`[SCOUT] \u{1F6A8} DESKTOP SWITCH: "${currentDesktopName}" \u{2192} "${inputName}"`);

585 migrateToDesktop(inputName);

586 }

587 }

bin/uia_extract.exeView file

•path = bin/uia_extract.exe kind = native_binary sizeBytes = 27456832 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/uia_extract.exeView on unpkg

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11973 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg