MAL-2026-14212

    Dashboard / Malicious Package / MAL-2026-14212

    MAL-2026-14212

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in syboy (npm)

    Details: Source: amazon-inspector (f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7) On invocation, index.js spawns start_tool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' verb and window state 0 to silently launch pointer.py under Administrator with no console, then the Node process exits leaving a hidden elevated background process. pointer.py reads the clipboard continuously, captures screenshots via mss/ImageGrab, walks the UI accessibility tree of foreground windows via uiautomation, and installs many global keyboard hotkeys via the keyboard module. The collected clipboard, screen, and UI content is POSTed to a hardcoded author-controlled endpoint at https://iq-overlay-pointer.vercel.app/api with no user-configurable destination. A Tk overlay is rendered with an empty title, transparent color, and overrideredirect to remain hidden from the user and screen-sharing. index.js additionally downloads the official Python 3.12.3 installer from python.org via curl to %TEMP% and runs it with /quiet InstallAllUsers=0 PrependPath=1 as a silent runtime dropper fallback when winget is unavailable, then deletes the installer.

    References: https://www.npmjs.com/package/syboy/v/1.0.0

    Affected packages

    Package

    Name: syboy

    Purl: pkg:npm/syboy

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14212 | CVE-DB