Malicious code in saaa9 (npm)

The 'saaa9' npm package (version 1.0.0) is a malicious package that disguises itself as a system binary configuration tool. Its index.js script executes wscript.exe to silently relaunch cmd.exe with administrator privileges and runs a bundled Python script (pointer.py). If Python is not installed, it silently installs Python 3.12.3 from official sources. The Python script registers global keyboard hotkeys to capture clipboard contents, take screenshots of the active desktop, extract text from the screen using accessibility APIs, and exfiltrate this data via HTTP POST requests to a hardcoded endpoint. Responses from the server are automatically typed or pasted back into the active window. The package uses a concealed tkinter UI to maintain stealth, confirmed by comments in the code. This behavior is inconsistent with the package's stated purpose and represents a covert surveillance backdoor.

This malicious package can silently gain administrator privileges on Windows systems, install Python if absent, and perform continuous surveillance by capturing clipboard data, screenshots, and on-screen text. It exfiltrates sensitive information to a remote server and can inject server responses into active windows, potentially leading to data theft, unauthorized system control, and further compromise of the affected system.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or using the 'saaa9' npm package version 1.0.0. Remove any installations of this package immediately and conduct a thorough investigation for potential compromise. Monitor for unauthorized Python installations and suspicious processes such as wscript.exe or cmd.exe running with elevated privileges triggered by npm packages. Use trusted sources and verify package integrity before installation.