MAL-2026-10462

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hehehee/MAL-2026-10462.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10462
Published
2026-07-13T17:48:34Z
Modified
2026-08-19T09:30:14Z
Summary
Malicious code in hehehee (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628)

Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code (main.js) is a stealth Electron overlay designed to defeat Safe Exam Browser and similar proctoring tools. config.json ships a real-looking __Secure-next-auth.session-token JWE for chatgpt.com; main.js loads it at startup and injects it into a persist:chatgpt Electron session before navigating to chatgpt.com, so every screenshot/UIA-extracted text the tool sends through ChatGPT goes through a hardcoded account that the package author (or whoever harvested the cookie) controls and can read in conversation history. The bin (bin/kalamasha-tool.js) copies the bundled electron.exe to a sibling named SearchFilterHost.exe (the real Windows Search Filter Host system binary) inside node_modules/electron/dist and spawns it as a detached watchdog with randomised 1–25s respawn jitter, persisting under %LOCALAPPDATA%\Microsoft\Windows\Diagnostics (a path mimicking a Microsoft-owned directory) and only stopping when a .kill_watchdog file appears. The CLI also auto-runs npm install <missing> --no-save at runtime for missing native modules without user consent. The combination of fraudulent package description, process-name masquerade as a Windows system binary, persistence with anti-kill respawn, anti-proctor stealth (WDA_EXCLUDEFROMCAPTURE, anti-Alt-Tab styling, cross-desktop migration), and a hardcoded ChatGPT session that silently relays user screen content to a third-party account constitutes a clear supply-chain harm to anyone following the README's quick-start instructions.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010279",
            "import_time": "2026-07-13T18:10:13.061629775Z",
            "modified_time": "2026-07-13T17:48:34Z",
            "sha256": "efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628",
            "source": "amazon-inspector",
            "versions": [
                "1.0.9"
            ]
        },
        {
            "id": "IN-MAL-2026-015834",
            "import_time": "2026-08-05T18:07:50.74852506Z",
            "modified_time": "2026-08-05T17:26:26Z",
            "sha256": "198ce12fe394dbca0c22ccbcce2586ce8ce3b7eb99f327fd08141096357d6399",
            "source": "amazon-inspector",
            "versions": [
                "2.0.21"
            ]
        },
        {
            "id": "IN-MAL-2026-015835",
            "import_time": "2026-08-05T18:07:50.896388448Z",
            "modified_time": "2026-08-05T17:26:37Z",
            "sha256": "939a19607dacefc200d82c1e7798b2c83036579affc958f2a6083b5eaa3690a8",
            "source": "amazon-inspector",
            "versions": [
                "2.0.22"
            ]
        },
        {
            "id": "IN-MAL-2026-018414",
            "import_time": "2026-08-19T09:15:25.056435452Z",
            "modified_time": "2026-08-19T08:50:28Z",
            "sha256": "28becc967fd781d77b0f8c2fd714ead0e013eec144ad2141dd7c2451a56f1ddd",
            "source": "amazon-inspector",
            "versions": [
                "2.0.19"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / hehehee

Package

Name
hehehee
View open source insights on deps.dev
Purl
pkg:npm/hehehee

Affected ranges

Affected versions

1.*
1.0.9
2.*
2.0.19
2.0.21
2.0.22

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "config.json",
            "sha256": "324f44847850605042c9deb9ef43aaec2b836de0bec9643157d95d82624cd144",
            "tlsh": "63916cc198766407501f60fee87b2689a21a1783f325e91e70a483070b7b2b79ca2574"
        },
        {
            "path": "main.js",
            "sha256": "82d95719cb7a1522470d2978fa73f44ccedc35206e5cc11a1cc9a16ddc706edd",
            "tlsh": "6b93e7596021213584326f768b37ad16f726a123e441d354beacc3d82fb1459ceb2fee"
        },
        {
            "path": "bin/kalamasha-tool.js",
            "sha256": "426a20b401c6a1ab58b7014d3c89b4d5e7b011ef25307c482c29b02f782cfff0",
            "tlsh": "d4f15249a266133459b15fea5b331c0adb2bd123d5455384b89c83ca3f3642ccda6eee"
        }
    ],
    "package_integrity": [
        {
            "filename": "hehehee-2.0.21.tgz",
            "hashes": {
                "sha1": "93df89d5093c7e397196d25adde7142d712a29d1",
                "sha512_sri": "sha512-A39/nEJZaMc0Pm35GCb0PrkZ1ODKOi2FnZ4Y9qFLRMfP6fY9gzzbDPJSBYhzpPkxw3krKrko7Fg76RXyKga7uA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hehehee/MAL-2026-10462.json"