Malicious code in bqq1 (npm)
The npm package bqq1 version 1.0.0 masquerades as a system binary configuration tool but contains malicious code that installs Python 3.12 silently and runs a Python script that captures keystrokes, clipboard data, screenshots, and UI text. This data is sent to a remote server, which then sends commands back to the infected host to type text remotely controlled by an attacker. The package uses stealth techniques including transparent windows and hotkeys to hide its activity.
AI Analysis
Technical Summary
The npm package bqq1 (version 1.0.0) contains a covert surveillance and remote-control payload. Upon requiring or starting the package, it executes startApp(), which silently installs Python 3.12 if not present, installs fixed Python dependencies, and runs pointer.py. This script installs global keyboard hooks, captures clipboard contents, screenshots, and scrapes UI text from other applications. The collected data is exfiltrated via POST requests to a hardcoded endpoint (https://iq-sec.vercel.app/api). The response from this endpoint is used to remotely type text into the active window using pyautogui, controlled by global hotkeys. The package employs stealth UI elements such as borderless transparent windows and hotkeys for hiding or exiting, contradicting its advertised purpose.
Potential Impact
This malicious package enables attackers to perform covert surveillance by capturing sensitive user input, clipboard data, screen contents, and UI text. It also allows remote control of the victim's keyboard input, potentially enabling data manipulation or further compromise. The stealth features make detection difficult. The impact includes privacy violations, data exfiltration, and remote manipulation of the infected system.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately uninstall the bqq1 package version 1.0.0 and avoid using this package. Review and remove any installed Python 3.12 instances and related dependencies installed by this package. Monitor for suspicious network connections to https://iq-sec.vercel.app/api and investigate any unexpected keyboard or UI activity. Consider using trusted package sources and verifying package integrity before installation.
Malicious code in bqq1 (npm)
Description
The npm package bqq1 version 1.0.0 masquerades as a system binary configuration tool but contains malicious code that installs Python 3.12 silently and runs a Python script that captures keystrokes, clipboard data, screenshots, and UI text. This data is sent to a remote server, which then sends commands back to the infected host to type text remotely controlled by an attacker. The package uses stealth techniques including transparent windows and hotkeys to hide its activity.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The npm package bqq1 (version 1.0.0) contains a covert surveillance and remote-control payload. Upon requiring or starting the package, it executes startApp(), which silently installs Python 3.12 if not present, installs fixed Python dependencies, and runs pointer.py. This script installs global keyboard hooks, captures clipboard contents, screenshots, and scrapes UI text from other applications. The collected data is exfiltrated via POST requests to a hardcoded endpoint (https://iq-sec.vercel.app/api). The response from this endpoint is used to remotely type text into the active window using pyautogui, controlled by global hotkeys. The package employs stealth UI elements such as borderless transparent windows and hotkeys for hiding or exiting, contradicting its advertised purpose.
Potential Impact
This malicious package enables attackers to perform covert surveillance by capturing sensitive user input, clipboard data, screen contents, and UI text. It also allows remote control of the victim's keyboard input, potentially enabling data manipulation or further compromise. The stealth features make detection difficult. The impact includes privacy violations, data exfiltration, and remote manipulation of the infected system.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately uninstall the bqq1 package version 1.0.0 and avoid using this package. Review and remove any installed Python 3.12 instances and related dependencies installed by this package. Monitor for suspicious network connections to https://iq-sec.vercel.app/api and investigate any unexpected keyboard or UI activity. Consider using trusted package sources and verifying package integrity before installation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14164
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4caacd9273b49252e8a
Added to database: 08/19/2026, 13:51:06 UTC
Last enriched: 08/19/2026, 14:51:47 UTC
Last updated: 08/19/2026, 21:20:32 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.