{"id":"MAL-2026-10462","summary":"Malicious code in hehehee (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628)\nPackage metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code (main.js) is a stealth Electron overlay designed to defeat Safe Exam Browser and similar proctoring tools. config.json ships a real-looking `__Secure-next-auth.session-token` JWE for chatgpt.com; main.js loads it at startup and injects it into a `persist:chatgpt` Electron session before navigating to chatgpt.com, so every screenshot/UIA-extracted text the tool sends through ChatGPT goes through a hardcoded account that the package author (or whoever harvested the cookie) controls and can read in conversation history. The bin (bin/kalamasha-tool.js) copies the bundled electron.exe to a sibling named `SearchFilterHost.exe` (the real Windows Search Filter Host system binary) inside node_modules/electron/dist and spawns it as a detached watchdog with randomised 1–25s respawn jitter, persisting under `%LOCALAPPDATA%\\Microsoft\\Windows\\Diagnostics` (a path mimicking a Microsoft-owned directory) and only stopping when a `.kill_watchdog` file appears. The CLI also auto-runs `npm install \u003cmissing\u003e --no-save` at runtime for missing native modules without user consent. The combination of fraudulent package description, process-name masquerade as a Windows system binary, persistence with anti-kill respawn, anti-proctor stealth (WDA_EXCLUDEFROMCAPTURE, anti-Alt-Tab styling, cross-desktop migration), and a hardcoded ChatGPT session that silently relays user screen content to a third-party account constitutes a clear supply-chain harm to anyone following the README's quick-start instructions.\n","modified":"2026-08-19T09:30:14.939636162Z","published":"2026-07-13T17:48:34Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-13T18:10:13.061629775Z","modified_time":"2026-07-13T17:48:34Z","sha256":"efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628","source":"amazon-inspector","versions":["1.0.9"],"id":"IN-MAL-2026-010279"},{"versions":["2.0.21"],"id":"IN-MAL-2026-015834","import_time":"2026-08-05T18:07:50.74852506Z","modified_time":"2026-08-05T17:26:26Z","sha256":"198ce12fe394dbca0c22ccbcce2586ce8ce3b7eb99f327fd08141096357d6399","source":"amazon-inspector"},{"import_time":"2026-08-05T18:07:50.896388448Z","modified_time":"2026-08-05T17:26:37Z","sha256":"939a19607dacefc200d82c1e7798b2c83036579affc958f2a6083b5eaa3690a8","source":"amazon-inspector","versions":["2.0.22"],"id":"IN-MAL-2026-015835"},{"modified_time":"2026-08-19T08:50:28Z","sha256":"28becc967fd781d77b0f8c2fd714ead0e013eec144ad2141dd7c2451a56f1ddd","source":"amazon-inspector","versions":["2.0.19"],"id":"IN-MAL-2026-018414","import_time":"2026-08-19T09:15:25.056435452Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hehehee/v/1.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hehehee/v/2.0.21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hehehee/v/2.0.22"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hehehee/v/2.0.19"}],"affected":[{"package":{"name":"hehehee","ecosystem":"npm","purl":"pkg:npm/hehehee"},"versions":["1.0.9","2.0.21","2.0.22","2.0.19"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"63916cc198766407501f60fee87b2689a21a1783f325e91e70a483070b7b2b79ca2574","path":"config.json","sha256":"324f44847850605042c9deb9ef43aaec2b836de0bec9643157d95d82624cd144"},{"path":"main.js","sha256":"82d95719cb7a1522470d2978fa73f44ccedc35206e5cc11a1cc9a16ddc706edd","tlsh":"6b93e7596021213584326f768b37ad16f726a123e441d354beacc3d82fb1459ceb2fee"},{"path":"bin/kalamasha-tool.js","sha256":"426a20b401c6a1ab58b7014d3c89b4d5e7b011ef25307c482c29b02f782cfff0","tlsh":"d4f15249a266133459b15fea5b331c0adb2bd123d5455384b89c83ca3f3642ccda6eee"}],"package_integrity":[{"filename":"hehehee-2.0.21.tgz","hashes":{"sha1":"93df89d5093c7e397196d25adde7142d712a29d1","sha512_sri":"sha512-A39/nEJZaMc0Pm35GCb0PrkZ1ODKOi2FnZ4Y9qFLRMfP6fY9gzzbDPJSBYhzpPkxw3krKrko7Fg76RXyKga7uA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hehehee/MAL-2026-10462.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}