The 'hehehee' npm package version 1.0.9 advertises itself as a Windows diagnostic and DOM utility but contains a stealth Electron overlay that defeats proctoring tools. It injects a hardcoded ChatGPT session token into an Electron session to silently relay user screen content to an attacker-controlled account. The package achieves persistence by masquerading its Electron executable as the legitimate Windows Search Filter Host binary, spawning a watchdog process with randomized respawn intervals under a path mimicking a Microsoft directory. It also auto-runs npm install commands for missing native modules without user consent. These combined techniques enable covert data exfiltration and persistence, representing a clear supply-chain compromise.

Users installing 'hehehee' version 1.0.9 risk having their screen content and UI-extracted text captured and sent to an attacker-controlled ChatGPT account without their knowledge. The package evades detection by proctoring software and persists on the system by masquerading as a legitimate Windows process with automatic respawn. This results in unauthorized data exposure and persistent malicious presence on affected systems.

No official patch or remediation is currently documented. Users should avoid installing or using the 'hehehee' npm package version 1.0.9. Remove any installations of this package immediately. Monitor for and terminate any suspicious Electron processes named 'SearchFilterHost.exe' running from non-standard locations. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory or npm registry for updates. Exercise caution when installing npm packages, especially those with suspicious descriptions or behaviors.