Malicious code in bamru (npm)

The 'bamru' npm package (version 1.0.0) falsely advertises itself as a system binary configuration tool but actually installs and runs a hidden Python-based spyware component. Upon execution, it silently installs Python 3.12 if absent, then launches a VBScript that runs a Python script with administrator privileges and no visible window. This script monitors clipboard changes, captures screenshots, and scrapes text from the Windows UI Automation tree, sending this sensitive data to a hardcoded remote endpoint (https://new-pointer.vercel.app/api). The remote endpoint's responses are then typed back into the user's active window with randomized delays to mimic human input, establishing a covert remote control channel. The package deliberately conceals its behavior by hiding windows, blanking titles, and suppressing UI decorations. No install hooks exist; the malicious behavior triggers when the user runs the package command. The deception and stealth techniques indicate intentional malicious design.

This package enables unauthorized collection of clipboard contents, screenshots, and text from other applications, potentially exposing sensitive user data. It also establishes a covert remote control channel by typing commands into the user's active window, which could lead to further compromise or data manipulation. The silent elevation to administrator privileges increases the risk by granting the malware high-level access to the system. The hidden nature of the UI and lack of disclosure prevent users from detecting or consenting to these actions.

No official patch or remediation is currently documented for this package. Users should avoid installing or running the 'bamru' npm package version 1.0.0. Since the package silently installs Python and runs elevated scripts, removing the package and any installed Python runtimes provisioned by it is recommended. Monitor for suspicious network connections to the hardcoded endpoint and consider blocking access to https://new-pointer.vercel.app/api. Due to the lack of install hooks, the malicious behavior only occurs upon explicit execution of the package command, so do not run the package if already installed. Check vendor advisories or npm security advisories for updates or removal notices.