Malicious code in sysc1 (npm)

The sysc1 npm package (versions 1.0.0 and 1.0.1) declares itself as a system binary configuration tool but includes a malicious payload that installs Python silently and uses Python libraries (keyboard, pyautogui, mss, uiautomation, pywin32) to create a transparent overlay with global hotkeys for stealth control. It captures screenshots, clipboard contents, and scrapes UI text from other running applications, including a specific bypass to extract text from Chrome. This data is sent to a hardcoded external endpoint (https://new-pointer.vercel.app/api), enabling covert surveillance and data exfiltration upon package load or execution.

This malicious package compromises user privacy and security by silently installing software and exfiltrating sensitive data such as screenshots, clipboard contents, and application UI text to an attacker-controlled server. It enables covert surveillance on affected systems, potentially exposing confidential information without user consent.

No official patch or remediation is currently available. Users should immediately uninstall the sysc1 package versions 1.0.0 and 1.0.1 and avoid installing or using this package. Monitor for any unauthorized Python installations or suspicious network connections to the indicated endpoint. Consider using trusted package sources and verifying package integrity before installation.