MAL-2026-14270

    Dashboard / Malicious Package / MAL-2026-14270

    MAL-2026-14270

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in nodealpha (npm)

    Details: Source: amazon-inspector (423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e) The package installs a global keyboard hook (keyboard.add_hotkey on ctrl+c), polls the system clipboard every 300ms via pyperclip.paste(), and captures full-screen screenshots via ImageGrab.grab(). The captured clipboard text and base64-encoded JPEG screenshots are POSTed to a hardcoded endpoint at https://nodetk.vercel.app/api (API_URL constant, session.post(API_URL, json={'image': img_data,...})). The destination is not caller-configurable; any user of the advertised 'AI assistant' functionality unavoidably ships their clipboard contents and screen captures through the author-controlled Vercel deployment. Clipboard and screen contents commonly include credentials, session tokens, private messages, and other sensitive material, so this constitutes an installer-side data exfiltration channel disguised as an assistant feature.

    References: https://www.npmjs.com/package/nodealpha/v/1.0.7

    Affected packages

    Package

    Name: nodealpha

    Purl: pkg:npm/nodealpha

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.7