Malicious Code Injection in moidevl Package: A Threat to User Privacy
Summary
MAL-2026-16441: Malicious code in moidevl (npm). Affects moidevl versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The moidevl package is an npm library designed for developers, but it has been compromised to include malicious code. This package is intended to facilitate development tasks, yet it has been found to implement features that undermine user security and privacy, particularly in the context of remote examinations.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code that creates an anti-proctoring overlay, allowing users to cheat on remote exams. The package disguises itself as a legitimate Windows utility while secretly monitoring and manipulating browser cookies to access sensitive user data. This threat is particularly severe as it can lead to unauthorized access to user accounts on various platforms, including OpenAI services.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall moidevlIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can monitor their systems for any unauthorized processes or network activity related to the moidevl package. Additionally, consider using security software to detect and remove any malicious components.
Conclusion
The moidevl package has been identified as containing malicious code that poses significant risks to user privacy and security. It is crucial for developers to remove this package and monitor their applications for any signs of compromise. Utilizing tools like Vulert can help in identifying vulnerabilities in real-time.
See every vulnerability recorded for moidevl →
FAQ
The moidevl package is an npm library used for development tasks, but it has been compromised to include malicious functionalities.
The malicious code creates an anti-proctoring overlay that allows users to cheat on exams by hiding the exam window and manipulating browser cookies.
The risks include unauthorized access to sensitive user data, potential account takeovers, and violation of academic integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without any signup.
Immediately remove the package from your project and monitor your system for any suspicious activity. Consider updating to a patched version if available.
