MAL-2026-14213

Dashboard / Malicious Package / MAL-2026-14213

MAL-2026-14213

Summary: Malicious code in syjoy (npm)

Details: Source: amazon-inspector (d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529) The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload (pointer.py) that harvests user data across processes and provides a remote input channel into the host. On first invocation, index.js silently installs Python 3.12 (via winget, falling back to a /quiet install of python-3.12.3-amd64.exe fetched from python.org) and launches pointer.py through start_tool.vbs, which uses ShellExecute cmd.exe with 'runas' and window-hidden flags to run elevated and invisibly; index.js spawns wscript.exe detached with stdio ignored and windowsHide true. pointer.py registers global keyboard hooks, reads the clipboard via pyperclip, captures screenshots via mss/ImageGrab, and walks other applications' UI Automation trees to extract text from arbitrary windows, then POSTs the harvested content to the hardcoded endpoint https://new-pointer.vercel.app/api. Responses from that endpoint are fed back to the host through pyautogui/keyboard automation (hotkeys such as '1+v', mash mode, 'a+v' force_paste), so the remote server chooses text that is typed into whichever window is focused. The Tk UI blanks window titles and uses transparent/overlay attributes to remain hidden. Internal mode names (aptitude, dsa, fullstack, aws, ocr) indicate the real function is a covert assessment/interview cheating overlay, not a binary configuration utility.

References: https://www.npmjs.com/package/syjoy/v/1.0.0