Malicious code in nibra1 (npm)

The nibra1 npm package (version 1.0.0) includes a CLI entry script (index.js) that launches a Python payload (pointer.py). This payload registers global keyboard hooks, polls the clipboard, captures screenshots, and extracts on-screen text via UI-Automation. Captured data is sent to a hardcoded remote endpoint (https://iq-sec.vercel.app/api). The server's responses control local keyboard input through pyautogui and keyboard synthesis, enabling remote command execution via simulated keystrokes. The package attempts to silently install Python 3.12 if not already installed, using winget or by downloading and running the official installer with no UI or admin prompts. The payload runs hidden using VBScript and stealth Tkinter windows to conceal its presence.

This malicious package can exfiltrate sensitive user data including clipboard contents, screenshots, and on-screen text. It enables remote attackers to inject arbitrary keyboard input, potentially leading to unauthorized actions on the victim's machine. The stealth installation and operation increase the risk of prolonged undetected compromise on affected systems.

No official patch or remediation is currently documented. Users should avoid installing or using the nibra1 package version 1.0.0. Remove the package and any installed Python payloads if detected. Monitor for suspicious processes related to Python or VBScript running stealthily. Since this is a malicious package, the best mitigation is to rely on trusted package sources and verify package integrity before installation.