Malicious code in sysc1 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f) Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invokes startApp() at top level; on require or npm start, index.js silently installs Python (via winget or a fetch of python-3.12.3-amd64.exe run with /quiet InstallAllUsers=0 PrependPath=1), pip-installs keyboard, pyautogui, mss, uiautomation, and pywin32, then spawns the bundled pointer.py. pointer.py creates a topmost transparent overrideredirect Tk overlay (alpha 0.75) with multiple stealth hide/show/panic-exit global hotkeys, captures screenshots via ImageGrab/mss, reads the clipboard, and walks the UI trees of other running applications (including a documented 'CHROME BYPASS' that increases uiautomation WalkControl depth to scrape text out of Chrome). The captured screen contents, clipboard data, and text harvested from unrelated applications are POSTed with requests.Session to the hardcoded author-controlled endpoint https://new-pointer.vercel.app/api. The advertised package purpose is inconsistent with the shipped behavior; the stealth overlay, global hotkeys, cross-application UI scraping, silent Python bootstrap, and hardcoded exfiltration endpoint together form an on-load surveillance dropper.
Malicious code in sysc1 (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f) Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invokes startApp() at top level; on require or npm start, index.js silently installs Python (via winget or a fetch of python-3.12.3-amd64.exe run with /quiet InstallAllUsers=0 PrependPath=1), pip-installs keyboard, pyautogui, mss, uiautomation, and pywin32, then spawns the bundled pointer.py. pointer.py creates a topmost transparent overrideredirect Tk overlay (alpha 0.75) with multiple stealth hide/show/panic-exit global hotkeys, captures screenshots via ImageGrab/mss, reads the clipboard, and walks the UI trees of other running applications (including a documented 'CHROME BYPASS' that increases uiautomation WalkControl depth to scrape text out of Chrome). The captured screen contents, clipboard data, and text harvested from unrelated applications are POSTed with requests.Session to the hardcoded author-controlled endpoint https://new-pointer.vercel.app/api. The advertised package purpose is inconsistent with the shipped behavior; the stealth overlay, global hotkeys, cross-application UI scraping, silent Python bootstrap, and hardcoded exfiltration endpoint together form an on-load surveillance dropper.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14214
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c7acd9273b49252845
Added to database: 08/19/2026, 13:51:03 UTC
Last updated: 08/19/2026, 13:51:35 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.