The 'syspo' npm package (versions 1.0.0, 1.0.1, and 1.0.2) is a malicious package that acts as a Windows surveillance dropper. It silently installs Python 3.12 if not present, then installs multiple Python libraries used for capturing keyboard input, screenshots, and UI automation data. It launches a VBScript in stealth mode with elevated privileges to run a Python script that registers global keyboard hotkeys, captures screen regions, extracts text from UI elements including password fields, encodes screenshots, and sends the collected data to a hardcoded external endpoint (https://new-pointer.vercel.app/api). The package uses transparent, minimal UI windows to conceal its activity from the user.

This malicious package enables remote surveillance by capturing sensitive user input such as keyboard strokes, screenshots, and text from UI elements including password fields. The data is exfiltrated to an attacker-controlled server, potentially leading to credential theft, privacy violations, and unauthorized access to sensitive information. The use of elevated privileges and stealth techniques increases the risk and difficulty of detection.

No official patch or remediation is provided for this malicious package. The best mitigation is to avoid installing or using the 'syspo' npm package versions 1.0.0, 1.0.1, and 1.0.2. Remove any installations of this package immediately and investigate affected systems for signs of compromise. Employ trusted sources for npm packages and verify package authenticity before installation.