Malicious code in nodeberlin (npm)

The nodeberlin package (npm ecosystem) version 1.0.7 includes malicious functionality that polls the system clipboard every 300 milliseconds and captures full or partial screenshots. It sends the clipboard text and base64-encoded JPEG images to a fixed, attacker-controlled URL (https://tokyoap.vercel.app/api), which is not configurable by the user. On first execution, the package downloads the Python.org installer and installs several Python libraries (keyboard, pyautogui, pillow, pyperclip, requests) to support its keylogging, screen capture, and data relay capabilities. The package includes a panic-exit hotkey and stealth overlay to evade detection. This results in unauthorized exfiltration of potentially sensitive data through the attacker's proxy.

Sensitive user data such as clipboard contents and screenshots, which may include credentials and private communications, are exfiltrated to an attacker-controlled endpoint without user knowledge or consent. This compromises user privacy and security, potentially leading to credential theft, data leakage, and further compromise of affected systems.

No official patch or remediation is currently available for this malicious package version. Users should immediately uninstall nodeberlin version 1.0.7 and avoid installing this package. Verify all installed npm packages for authenticity and source. Consider scanning systems for the presence of the Python dependencies installed by this package and remove any unauthorized files or processes related to nodeberlin. Monitor for suspicious network connections to the hardcoded endpoint. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.