The 'hehehee' npm package (version 1.0.9) advertises itself as a Windows diagnostic and high-performance DOM utility but contains a stealth Electron overlay designed to bypass proctoring tools like Safe Exam Browser. It loads a hardcoded '__Secure-next-auth.session-token' JSON Web Encryption token for chatgpt.com and injects it into a persistent Electron session, allowing the attacker to access all user screenshots and UI-extracted text routed through ChatGPT. The package achieves persistence by copying the Electron executable to a file named 'SearchFilterHost.exe' within its node_modules directory, mimicking a legitimate Windows system binary, and runs it as a detached watchdog process with randomized respawn intervals. It also uses anti-capture flags and UI tricks to evade detection and automatically runs 'npm install' for missing native modules without user consent. This combination of deceptive packaging, persistence, stealth, and data exfiltration represents a significant supply-chain compromise.

Users installing and running version 1.0.9 of the 'hehehee' npm package risk having their screen content and UI-extracted text silently captured and relayed to a third-party controlled ChatGPT account. The package's persistence mechanism and masquerade as a legitimate Windows system process make detection and removal difficult. The automatic installation of missing native modules without consent can introduce further risk. This results in a severe privacy breach and potential exposure of sensitive information, especially in environments relying on proctoring tools.

No official patch or remediation is currently available for this malicious package version. Users should immediately uninstall the 'hehehee' package version 1.0.9 and avoid using this package from untrusted sources. Review and remove any persisted instances of the 'SearchFilterHost.exe' watchdog process under '%LOCALAPPDATA%\Microsoft\Windows\Diagnostics'. Monitor for suspicious Electron processes masquerading as system binaries. Exercise caution when installing npm packages, especially those with unexpected or inconsistent descriptions. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.