The sysdo npm package version 1.0.0 contains malicious code that acts as a Windows surveillance harness. It installs Python silently and uses Python libraries (pyperclip, keyboard, mss, pyautogui, pywin32, uiautomation) to capture global keyboard input, clipboard data, screenshots, and UI automation tree text. The captured data is sent to a hardcoded external URL (https://iq-sec.vercel.app/api). The package creates borderless topmost windows with hidden titles and supports a panic hotkey to exit. It also allows injecting text into active windows, enabling covert operator assistance. The installer does not configure the exfiltration endpoint, indicating malicious intent. The surveillance script runs hidden via a VBScript launcher that suppresses console windows.

This malicious package compromises the confidentiality of the infected system by capturing sensitive user input, clipboard data, screen content, and UI text, then exfiltrating it to an attacker-controlled server. It also enables covert remote operator interaction with the system. This can lead to credential theft, data leakage, and unauthorized system control. The silent installation of Python and dependencies without user awareness increases the risk of undetected persistent surveillance.

No official patch or remediation is indicated. Users should immediately uninstall sysdo version 1.0.0 and remove any installed Python environment and related surveillance libraries installed by this package. Avoid installing packages from untrusted or unknown sources. Monitor network traffic for connections to the hardcoded exfiltration endpoint (https://iq-sec.vercel.app/api) and block it if possible. Conduct a full system scan for related artifacts and consider rebuilding affected systems to ensure removal of all malicious components.