MAL-2026-10428

    Dashboard / Malicious Package / MAL-2026-10428

    MAL-2026-10428

    Published: 13 Jul 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in sysb1 (npm)

    Details: Source: amazon-inspector (530efe2fec0ffeabda93aa5e9718161f131bb28d35f28432d5d2c2da6e4763a4) The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. index.js (declared as both main and bin) runs at load/start and silently installs the CPython 3.12 runtime via winget, falling back to downloading python-3.12.3-amd64.exe from python.org into the temp directory and running it with /quiet InstallAllUsers=0 PrependPath=1, then silently pip-installs surveillance libraries (keyboard, pyautogui, mss, uiautomation, pyperclip). It then spawns wscript.exe on start_tool.vbs detached and hidden; start_tool.vbs uses ShellExecute with the 'runas' verb and window state 0 to launch 'python pointer.py' as Administrator with no visible window. pointer.py captures clipboard content (pyperclip.paste), screenshots (ImageGrab, mss), and UI/accessibility text (uiautomation), and POSTs the collected data via requests.Session to a hardcoded endpoint https://iq-overlay-pointer.vercel.app/api that the installer did not configure. pointer.py also registers global keyboard hotkey hooks (keyboard.add_hotkey) that drive clipboard reads, screen OCR, keystroke injection (pyautogui.press), and network POSTs, running inside hidden overrideredirect/transparent-color Tk windows with a 'panic_exit' hotkey. Package metadata and identifiers ('IQPointer', 'ULTRA GHOST MODE', 'HACK 1/HACK 2', empty window titles) contradict the stated purpose and are a cover story.

    References: https://www.npmjs.com/package/sysb1/v/1.0.0, https://www.npmjs.com/package/sysb1/v/1.0.2, https://www.npmjs.com/package/sysb1/v/1.0.1, https://www.npmjs.com/package/sysb1/v/1.0.4, https://www.npmjs.com/package/sysb1/v/1.0.5, https://www.npmjs.com/package/sysb1/v/1.0.3

    Affected packages

    Package

    Name: sysb1

    Purl: pkg:npm/sysb1

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.2
    1.0.1
    1.0.4
    1.0.5
    1.0.3