Loading npm security reports…

sysverify@2.0.10: Malicious npm security report (Block) | LPM Firewall

registry / sysverify / 2.0.10

sysverify@2.0.10

High-performance DOM utility and diagnostic bridge for modern web applications.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

The launched application hides a persistent overlay, captures the foreground window, and transmits captured image content to an external AI service. Its launcher disguises and detaches the process, then respawns it when it exits.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running the sysverify command or its start script launches the detached watchdog; application hotkeys trigger capture and submission.

Impact

Foreground-window content can be covertly collected and disclosed externally while the process resists closure and disguises itself.

Mechanism

The launcher copies Electron under a misleading executable name and starts it detached. The application invokes PowerShell to capture the foreground window, builds a request containing the image, and posts it to the external service.

Attack narrative

The package metadata presents a diagnostic utility, but its launcher creates a detached process under the misleading name SearchApp and respawns it after termination. The Electron program uses a hidden overlay, invokes a PowerShell foreground-window screenshot helper, stores the image in a queue, and submits that image to an external AI completion endpoint. This combination provides covert collection, external disclosure, and persistence intended to evade supervision.

AI rationale

The source implements deceptive process disguise, persistence, covert screen capture, and external transmission rather than the advertised DOM diagnostic function. These concrete behaviors warrant blocking publication.

Evidence

package.jsonbin/kalamasha-tool.jsmain.jsbin/stealth_capture.ps1

Network endpoints

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

2Cross-file remote execution chain: bin/kalamasha-tool.js spawns main.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path'); ... L10: L11: const rootDir = path.resolve(__dirname, '..'); L12: const mainPath = path.resolve(rootDir, 'main.js'); L13: const appDataDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'Windows', 'Diagnostics'); L14: const bootLog = path.join(appDataDir, 'boot.log');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

•matchType = normalized_sha256 matchedPackage = moidevl@1.0.0 matchedPath = bin/kalamasha-tool.js matchedIdentity = npm:bW9pZGV2bA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

456// STRATEGY: Spawn a NEW electron process on the target desktop L457: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L458:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L456

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11705 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

456// STRATEGY: Spawn a NEW electron process on the target desktop L457: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L458:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L456

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11705 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('electron')}catch(e){console.log('Electron will download on first run.')}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/kalamasha-tool.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/kalamasha-tool.jsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/kalamasha-tool.jsView on unpkg · L2

66try { L67: execSync('npm install ' + missing.join(' ') + ' --no-save', { L68: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/kalamasha-tool.jsView on unpkg · L66

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/kalamasha-tool.jsView on unpkg

main.jsView file

456// STRATEGY: Spawn a NEW electron process on the target desktop L457: // via CreateProcessW (PowerShell helper). Parent stays alive and goes dormant. L458:

High

Shell

Package source references shell execution.

main.jsView on unpkg · L456

bin/chrome_cookies.ps1View file

•path = bin/chrome_cookies.ps1 kind = build_helper sizeBytes = 11705 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/chrome_cookies.ps1View on unpkg

sysverify@2.0.10

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code