Malicious code in syboy (npm)

The 'syboy' npm package version 1.0.0 executes a multi-stage malicious payload. Initially, index.js spawns a VBScript with elevated privileges to launch a hidden Python script (pointer.py) running as Administrator without a visible console. This script continuously monitors clipboard contents, captures screenshots using mss/ImageGrab, and inspects the UI accessibility tree of foreground windows via uiautomation. It also installs global keyboard hotkeys. All collected data is exfiltrated via POST requests to a hardcoded URL (https://iq-overlay-pointer.vercel.app/api). Additionally, the package silently downloads and installs Python 3.12.3 from the official source as a fallback runtime environment, deleting the installer afterward. The malicious overlay is rendered transparently and hidden from user view and screen-sharing.

This malicious package compromises user privacy and security by stealthily capturing sensitive data including clipboard contents, screenshots, and UI information. It runs with elevated privileges, increasing the risk of system compromise. The exfiltration of data to an attacker-controlled endpoint can lead to data leakage and further exploitation. The silent installation of Python 3.12.3 facilitates persistent malicious activity.

No official patch or remediation is currently documented. Users should avoid installing or using the 'syboy' npm package version 1.0.0. Remove the package if already installed and investigate systems for signs of the described malicious behavior. Monitor network traffic for connections to https://iq-overlay-pointer.vercel.app/api and consider blocking this endpoint. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.