Malicious code in hehehe (npm)

The 'hehehe' npm package is a malicious tool disguised as an enterprise Windows diagnostic utility. It contains code that steals browser session cookies from Chrome, Edge, and Brave by decrypting DPAPI-wrapped AES-256-GCM keys and reading Cookies SQLite databases for specific OpenAI-related domains. The stolen cookies are injected into the tool's Electron session to hijack ChatGPT logins. The package also masquerades its electron.exe process as a legitimate Windows Search subsystem process and employs techniques to evade proctoring software such as Testpad, AMCAT, and Safe Exam Browser. It executes an undocumented 27MB Windows PE binary without hash or signature verification, further indicating malicious behavior. The package is confirmed as a cheating tool with payloads targeting proctoring exams, and any system with it installed should be considered fully compromised.

Installation or execution of this package results in full compromise of the affected system. The attacker gains access to browser session cookies for OpenAI-related services, enabling account hijacking. The package also runs persistent background processes that evade detection and removal. Secrets and keys stored on the compromised computer are at risk and should be rotated immediately from a clean system. Removal of the package alone does not guarantee eradication of all malicious components.

Immediate removal of the 'hehehe' package is recommended. However, due to the full compromise risk, all secrets and keys stored on the affected system should be rotated from a different, uncompromised computer. Monitor for any persistent background processes masquerading as legitimate Windows services. There is no official patch or fix available; remediation requires system cleanup and credential rotation.