Exam-proctoring evasion tool bundled with a browser session-cookie stealer, disguised as a 'DOM utility and diagnostic bridge'. Payload ships in the tree and runs via bin.moidevx (bin/kalamasha-tool.js); the postinstall hook is an inert decoy. bin/chrome_cookies.ps1 copies the locked Cookies SQLite DB from every Chrome/Edge profile, strips the DPAPI prefix from Local State, calls ProtectedData::Unprotect and P/Invokes winsqlite3.dll to extract encrypted_value for .openai.com, .chatgpt.com, auth0.openai.com and auth.openai.com. bin/stealth_capture.ps1 performs GetForegroundWindow + CopyFromScreen screen capture to base64 in memory with no disk trace; bin/uia_extract.exe scrapes text from other applications' windows via UI Automation. kalamasha-tool.js:19 copies the Electron binary to SearchApp.exe to masquerade as Windows Search, hides state in %LOCALAPPDATA%\Microsoft\Windows\Diagnostics, and runs a detached windowsHide watchdog that respawns every 2s with backoff on a detected kill loop to resist proctoring software. Silently runs npm install uiohook-napi koffi --no-save at first run for global input hooking and raw FFI. No C2: stolen cookies are consumed locally.