
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
exam-guard
Advanced tools
AI Proctoring tool developed by Scaler
Clone the repository
https://github.com/aswanth9495/exam-guard.git
Run NPM install
npm i
For development: Run webpack dev server
npm run start
You will see the following screen on running the server.
For production:
To create the final build
npm run build
Features can be divided to:
AI Proctoring features
Non AI Proctoring features
Non-AI Proctoring Features
Disable Copy Paste
Disable Right Click
Disable Tab Switch
Disable Exit (Closing the tab)
Disable Keyboard shortcuts
Disable Text selections
Disable Full Screen
Disable Browser Window Switch
Take Screenshot of the page in intervals
Take webcam snapshot of the user in intervals
Note: Will also track the above proctoring events. We’ll add an event handler for tracking as well
AI proctoring features (To be Done)
All the features mentioned below uses the webcam snapshot taken.
Object Detection
Multiple Face detection
Eye Tracking
Webpack: Build tool
NPM: Package manager
JSDelivr: Free CDN service for hosting and delivering files from npm (Needed for apps for which we can’t use npm packages)
Each violation in the proctoring library can be customized using the following common configuration properties:
enabled (boolean): Specifies whether the violation detection is active. Default is true.
showAlert (boolean): Controls whether an alert should be shown when the violation occurs. Default is true.
recordViolation (boolean): Indicates whether to log the violation event. Default is true.
These settings can be overridden for each individual violation as needed.
**Tab Switch Violation (**VIOLATIONS.tabSwitch)
**Browser Blur Violation (**VIOLATIONS.browserBlur)
**Right Click Violation (**VIOLATIONS.rightClick)
**Exit Tab Violation (**VIOLATIONS.exitTab)
**Copy-Paste-Cut Violation (**VIOLATIONS.copyPasteCut)
**Restricted Key Event Violation (**VIOLATIONS.restrictedKeyEvent)
**Text Selection Violation (**VIOLATIONS.textSelection)
**Fullscreen Violation (**VIOLATIONS.fullScreen)
The proctoring library emits various events related to detected violations. Each event provides information about the type of violation and its details. Here's a breakdown of the events and associated methods for handling them:
Purpose: This method handles the detection of a violation by:
Creating a violation object with the type, value, and timestamp.
Showing a warning alert if configured.
Recording the violation if configured.
Dispatching a violation event.
Checking if the user should be disqualified based on the violation count.
Parameters:
type (string): The type of violation as defined in this.config.
value (any, optional): Additional value or context associated with the violation.
forceDisqualify (boolean, optional): If true, forces immediate disqualification regardless of the configured threshold.
Behavior:
If alerts are enabled for the violation type, it displays a warning message.
Records the violation if recording is enabled.
Dispatches a violation event for further handling or logging.
Checks if the user has reached the threshold for disqualification and disqualifies the user if needed.
Purpose: This method allows the attachment of a callback function to a specific violation type event.
Parameters:
violationType (string): The type of violation to listen for. It should match one of the configured violation types.
callback (function): The function to be called when the violation event is triggered. Receives the total count of violations of the specified type and the event object.
Behavior:
Adds an event listener for the specified violation type.
Calls the provided callback function with the total count of violations of that type and the event object whenever the violation occurs.
Purpose: Retrieves the total number of violations of a specific type.
Parameters:
Returns:
Behavior:
Purpose: Retrieves the total number of all recorded violations.
Returns:
Behavior:
Handling a Specific Violation:
proctor.on('tabSwitch', (count, event) => { console.log(`Tab switch detected. Total violations: ${count}`); });
Getting Total Violations Count:
const totalViolations = proctor.getTotalViolationsCount(); console.log(`Total violations: ${totalViolations}`);
Handling and Forcing Disqualification:
proctor.handleViolation('tabSwitch', null, true);
The compatibility check configuration ensures that the proctoring system verifies the user's environment to meet specific criteria. The configuration is used to perform various checks and manage their outcomes.
enable (boolean):
Description: Indicates whether compatibility checks are enabled.
Default: true
showAlert (boolean):
Description: Controls whether an alert should be shown when a compatibility check fails.
Default: true
Initialization: When the proctoring system starts, it runs an initial compatibility check and sets an interval to repeat these checks every 20 seconds.
Checking: The system performs the following checks:
Webcam: Ensures that the webcam is accessible.
Network Speed: Verifies if the network speed is adequate.
Fullscreen: Checks if the application is running in fullscreen mode.
Handling Results:
Success: If all checks pass, a success callback is triggered.
Failure: If any check fails, a failure callback is triggered, and a disqualification timer starts if needed.
Disqualification:
runCompatibilityChecks(onSuccess, onFailure)
Purpose: Executes the compatibility checks and invokes the appropriate callback based on the result.
Parameters:
onSuccess (function): Callback function to handle successful checks.
onFailure (function): Callback function to handle failed checks.
Example:
proctor.runCompatibilityChecks(
(passedChecks) => {
console.log('Compatibility checks passed:', passedChecks);
},
(failedCheck, passedChecks) => {
console.log('Compatibility check failed:', failedCheck);
console.log('Passed checks:', passedChecks);
}
);
startCompatibilityChecks()
Purpose: Begins running compatibility checks at regular intervals and handles their results.
Example:
proctor.startCompatibilityChecks(
(passedChecks) => {
console.log('Compatibility checks passed:', passedChecks);
},
(failedCheck, passedChecks) => {
console.log('Compatibility check failed:', failedCheck);
console.log('Passed checks:', passedChecks);
}
);
stopCompatibilityChecks()
Purpose: Stops ongoing compatibility checks and any associated timers.
Example:
proctor.stopCompatibilityChecks();
Description: Triggered when the user is disqualified due to violating the proctoring rules.
Parameters: None.
Description: Called when the webcam is disabled or becomes unavailable.
Parameters: None.
Description: Called when the webcam is enabled or becomes available.
Parameters: None.
Description: Invoked when a snapshot is successfully captured.
Parameters:
Description: Invoked when snapshot capturing fails.
Parameters:
Description: Triggered when screenshot functionality is disabled.
Parameters: None.
Description: Triggered when screenshot functionality is enabled.
Parameters: None.
Description: Invoked when screenshot capturing fails.
Parameters:
Description: Invoked when a screenshot is successfully captured.
Parameters:
Description: Called when the application enters fullscreen mode.
Parameters: None.
Description: Called when the application exits fullscreen mode.
Parameters: None.
Description: Triggered when compatibility checks pass successfully.
Parameters:
Description: Invoked when compatibility checks fail.
Parameters:
failedCheck (string): Identifier of the failed check.
passedChecks (object): Details of the compatibility checks that passed.
The proctoring library is bundled using Webpack 5.94.0, which is a powerful tool for managing and optimizing the bundle and its dependencies. Webpack handles many aspects of compatibility, but there are additional considerations for browser support, particularly for features like camera access and snapshot functionality.
The proctoring library is designed to work across modern browsers. However, to ensure broad compatibility and proper functionality, including camera and snapshot features, follow these guidelines:
Supported Browsers:
Google Chrome: Latest stable version and recent versions.
Mozilla Firefox: Latest stable version and recent versions.
Safari: Latest stable version and recent versions.
Microsoft Edge: Latest stable version and recent versions.
Minimum Browser Requirements:
Google Chrome: Version 80+
Mozilla Firefox: Version 80+
Safari: Version 13+
Microsoft Edge: Version 80+
Features and Support:
Camera Access: Uses the WebRTC API, which is widely supported in modern browsers but may have varying levels of support in older versions or less common browsers. Ensure permissions are granted for camera access.
Snapshot Functionality: Relies on HTML5 Canvas for capturing snapshots. Most modern browsers support Canvas API, but ensure that your target browsers are updated.
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Proctoring Library Test</title>
</head>
<body>
<h1>Proctoringss Library Test</h1>
<!-- Image element to render the captured snapshot -->
<div>
<h2>Captured Snapshot:</h2>
<img id="snapshot" alt="Snapshot will appear here" style="max-width: 100%; height: auto;" />
</div>
<div>
<h2>Captured Screenshot:</h2>
<img id="screenshot" alt="Screenshot will appear here" style="max-width: 100%; height: auto;" />
</div>
<!-- Include the Webpack bundle -->
<script src="https://cdn.jsdelivr.net/npm/exam-guard@latest/dist/proctor.js"></script>
<script>
const proctor = new Proctor({
eventsUrl: 'https://example.com/events', // Replace with your actual events URL
config: {
tabSwitch: {
enabled: true,
showAlert: true,
recordViolation: true,
},
},
enableAllAlerts: true,
callbacks: {
onSnapshotSuccess: ({ blob }) => {
const snapshotImg = document.getElementById('snapshot');
if (snapshotImg) {
// Create a URL for the blob and set it as the src of the image element
const imageUrl = URL.createObjectURL(blob);
snapshotImg.src = imageUrl;
}
},
onScreenshotSuccess: ({ blob }) => {
const screenshotImg = document.getElementById('screenshot');
if (screenshotImg) {
// Create a URL for the blob and set it as the src of the image element
const imageUrl = URL.createObjectURL(blob);
screenshotImg.src = imageUrl;
}
}
}
});
proctor.initializeProctoring();
proctor.on('violation', (violations, event) => {
console.log('%c⧭', 'color: #ffa640', 'Violation detected', violations, event.detail.type);
});
</script>
</body>
</html>
FAQs
AI proctoring tool
We found that exam-guard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.