The npm package 'syspo' versions 1.0.0, 1.0.1, and 1.0.2 is a malicious package masquerading as a system binary configuration tool. Upon execution, it silently installs Python 3.12 and a surveillance toolchain, then runs a hidden script with elevated privileges to capture keyboard input, screenshots, and UI text from the user's system. The stolen data is exfiltrated to a hardcoded remote server. The package uses stealth techniques to hide its presence from the user.