MAL-2026-3773

Dashboard / Malicious Package / MAL-2026-3773

MAL-2026-3773

Summary: Malicious code in sysbin (npm)

Details: Source: amazon-inspector (8ab8ea4ce073a93a1973a062ac7661ceeaea9c312f9fd67e9acda9936e2b6578) Package metadata advertises sysbin as a 'System binary configuration tool' but the tarball ships pointer.py, a stealth overlay that runs automatically when index.js executes. index.js calls startApp() unconditionally at the bottom of the main module (triggered by `node index.js`, the `sys-bin` bin entry, `npm start`, or `require('sysbin')`). If Python is not present, index.js first tries `winget install Python.Python.3.12 --silent`, and on failure downloads https://www.python.org/ftp/python/3.12.3/python-3.12.3-amd64.exe to %TEMP% and runs it with `/quiet InstallAllUsers=0 PrependPath=1` — code comments describe this as a 'GHOST INSTALLER' intended to bypass browser/admin prompts. It then pip-installs pyperclip, keyboard, mss, pyautogui, pywin32, and uiautomation and launches pointer.py. pointer.py polls the clipboard every 300ms via pyperclip.paste() and POSTs every change to the hardcoded URL https://iq-overlay-pointer.vercel.app/api (pointer.py:281). It also binds hotkeys that capture full-screen screenshots via mss/ImageGrab, base64-encodes them as JPEG, and POSTs them to the same endpoint (pointer.py:231). The endpoint is hardcoded with no config surface, no documentation, and no consent prompt. Additional stealth features (panic_exit on Ctrl+Q, Esc-to-hide transparent Tk window, keystroke-replay 'mash-to-type' mode) confirm the tool is designed to hide from the machine's user. This is an intentional supply-chain attack: installing and running sysbin exfiltrates clipboard contents and screenshots to an author-controlled host.

References: https://www.npmjs.com/package/sysbin/v/1.0.34