Malicious code in gfff5 (npm)

The 'gfff5' npm package (version 1.0.0) is a malicious package that disguises itself as a system binary configuration tool. Upon invocation, it silently installs Python 3.12 on Windows systems using winget or the official installer with no user interface. It then installs Python libraries required by a bundled script, pointer.py, which registers global low-level keyboard hooks, captures screenshots, reads clipboard contents, and enumerates UI elements of other applications. The gathered data is exfiltrated via HTTP POST requests to a hardcoded endpoint (https://iq-sec.vercel.app/api). The package includes stealth features such as blank window titles, transparent overlays, and a panic hotkey to evade detection. This behavior is unrelated to the package's declared purpose and constitutes covert surveillance.

This malicious package compromises user privacy by capturing sensitive input data including keystrokes, clipboard contents, screenshots, and UI information from other applications. The exfiltration of this data to a remote server can lead to information disclosure and potential further exploitation. The silent installation of Python and stealth techniques increase the difficulty of detection and removal.

No official patch or remediation is currently documented for this malicious package. Users and organizations should avoid installing or using the 'gfff5' npm package version 1.0.0. Remove any existing installations immediately and monitor for suspicious network traffic to the indicated endpoint. Employ supply chain security measures such as package reputation checks and use trusted sources. Patch status is not yet confirmed — check vendor or repository advisories for updates.