The npm package 'hehehee' version 1.0.9 contains malicious code masquerading as a Windows diagnostic and DOM utility. It stealthily injects a hardcoded ChatGPT session token into an Electron session, enabling the package author to capture all screenshots and UI-extracted text sent through ChatGPT. The package also persists on the system by copying an Electron executable to mimic a legitimate Windows system binary and respawns itself with randomized delays, evading termination. It further employs anti-proctoring techniques to avoid detection in exam environments and automatically installs missing native modules without user consent. This behavior constitutes a supply-chain attack that compromises user privacy and system integrity.