Malicious code in sysb1 (npm)

The sysb1 npm package versions 1.0.0 through 1.0.5 include malicious functionality that installs a surveillance agent on Windows systems. The main script installs CPython 3.12 silently via winget or direct download, then installs Python libraries for keyboard and screen monitoring. It executes a hidden Visual Basic script to launch a Python script with administrator privileges. This Python script collects clipboard contents, screenshots, and UI accessibility text, then exfiltrates the data to a hardcoded endpoint. It also sets global keyboard hotkeys to automate data capture and keystroke injection, running in invisible windows with 'panic_exit' hotkeys. The package metadata contains misleading and suspicious identifiers, indicating a cover story for malicious intent.

Systems running affected versions of the sysb1 package are subject to unauthorized surveillance, including clipboard data capture, screenshot taking, UI text extraction, and keystroke injection. Sensitive information can be exfiltrated to a remote server without user consent. The malware runs with elevated privileges, increasing the potential impact on system confidentiality and integrity.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall all versions of sysb1 (1.0.0 through 1.0.5) and avoid installing packages from untrusted sources. Monitor for and remove any installed Python runtimes and surveillance libraries associated with this package. Since this is a malicious package rather than a traditional vulnerability, remediation involves removal and blocking of the package rather than patching. Check vendor or repository advisories for updates or takedown notices.