[Xposed Framework Modules] Lusty Rugnuts:
HiddenCore Module is back on the Xposed repository, and it attempted to do something which I don't think is on the up-and-up.

I've got Xposed Framework installed systemlessly as a module in Magisk. When it's enabled, Magisk cannot pass SafetyNet Check, but it passes fine when Xposed module is disabled. That's a pain, because once it's disabled, when you re-enable it, you've got to set up all the Xposed modules again. I've got AFWall+ Fixes and Greenify Experimental Features modules installed in Xposed.

Xposed Framework module named 'HiddenCore Module'

This purports to hide Xposed Framework from SafetyNet Check.

'HiddenCore Module' installs the following packages:

package:/data/app/com.cofface.ivader-1/base.apk=com.cofface.ivader

package:/data/app/com.C95dLCPN.Hd.qLqN-1/base.apk=com.C95dLCPN.Hd.qLqN

I'd just looked at my packages list not 5 minutes before installing HiddenCore Module (I'm paranoid like that), and made a comparison after installing HiddenCore Module.

Further, just as I installed HiddenCoreModule, I got notification of what appeared to be an OTA update (BLU_L0150WW_V7.0.04.13_GENERIC to BLU_L0150WW_V7.0.04.14_GENERIC)... except I have OTA updates disabled, and I was in Airplane Mode at the time... very suspicious. I had a WiFi connection, but my AFWall+ firewall profile was blocking all but the basic connectivity components. All Google components were blocked.

It then reboots your phone into Recovery Mode without warning... I'm guessing it was trying to install itself as bootloader, making the assumption that the bootloader on a rooted phone is unlocked... mine isn't (in fact, it's unlockable... still got the phone rooted and TWRP installed, though).

It also wipes out Magisk Manager. If you try to reinstall Magisk Manager with either of those packages installed, it will install but it won't do anything.

I had a recent Nandroid backup, so I wiped and restored, and all is back to normal. Don't forget to wipe your Dalvik cache as well, if you've had this thing on your phone.

{EDIT}

Grrrrr... damn you, Google! Apparently the "OTA" update was real... Google Update just pushed it at me again, I verified the connection details via adb logcat as it was downloading.

You'll note I've got OTA updates disabled, and I've got Google Play Store automatic updates disabled... yet Google sees fit to push an update I don't want and cannot install, and in so doing they reboot my phone at midnight every night. That's unconscionable.

So as I was attempting to install HiddenCore Module, Google was attempting to install a new ROM... and it was Google who rebooted my phone without prompt or warning into TWRP Recovery Mode. Apparently that borked the HiddenCore Module installation... I'm still not sure what the package:/data/app/com.C95dLCPN.Hd.qLqN-1/base.apk=com.C95dLCPN.Hd.qLqN is all about, and until the app's author explains in detail, I'm staying away from that Xposed Framework module.

To top it all off, Google messed up the updater script so it couldn't run! They were expecting the stock fastboot loader, and got TWRP Recovery Mode instead, so their script wouldn't properly verify the phone model. Unbelievable. I pulled the .zip file to the computer, unzipped it, edited the script, rezipped it, and pushed it back to the phone, but it still expects the default loader, so it's not running properly.