MAL-2026-14213

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/syjoy/MAL-2026-14213.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14213
Published
2026-08-19T02:50:45Z
Modified
2026-08-19T03:00:14.367833978Z
Summary
Malicious code in syjoy (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529)

The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload (pointer.py) that harvests user data across processes and provides a remote input channel into the host. On first invocation, index.js silently installs Python 3.12 (via winget, falling back to a /quiet install of python-3.12.3-amd64.exe fetched from python.org) and launches pointer.py through starttool.vbs, which uses ShellExecute cmd.exe with 'runas' and window-hidden flags to run elevated and invisibly; index.js spawns wscript.exe detached with stdio ignored and windowsHide true. pointer.py registers global keyboard hooks, reads the clipboard via pyperclip, captures screenshots via mss/ImageGrab, and walks other applications' UI Automation trees to extract text from arbitrary windows, then POSTs the harvested content to the hardcoded endpoint https://new-pointer.vercel.app/api. Responses from that endpoint are fed back to the host through pyautogui/keyboard automation (hotkeys such as '1+v', mash mode, 'a+v' forcepaste), so the remote server chooses text that is typed into whichever window is focused. The Tk UI blanks window titles and uses transparent/overlay attributes to remain hidden. Internal mode names (aptitude, dsa, fullstack, aws, ocr) indicate the real function is a covert assessment/interview cheating overlay, not a binary configuration utility.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T02:57:22.786762002Z",
            "sha256": "d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529",
            "modified_time": "2026-08-19T02:50:45Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018307",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / syjoy

Package

Name
syjoy
View open source insights on deps.dev
Purl
pkg:npm/syjoy

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/syjoy/MAL-2026-14213.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "040a190648080bc5f5141f9ee3a3ccabffddb571be9433033bd8ff3863541632",
            "tlsh": "ade2fa05ec4d0896c473de2e5852b823ff1a0b435a1e9e57f8bc99901f743468ae4ef9",
            "path": "pointer.py"
        },
        {
            "sha256": "3016a3871b47653d754b00e72221d205bb90f667b9a4e58751cbf044d330fcf5",
            "path": "start_tool.vbs",
            "tlsh": "e3f0204f42bdc81be05741b253868c2ee2b3d350b021d55a9db8f889210c0f099733db"
        },
        {
            "sha256": "8a2d3a7f4a8cc76665444ff335cdf03ffcc11ed8b81384d9ab95f3faab80d1a0",
            "tlsh": "a9b1600a8a599234ac3147e99b072127e507a1636201e25cbdfe83880f76659c077fee",
            "path": "index.js"
        },
        {
            "sha256": "adf3a2062224a545f9cd38959b7cee413eb462c3c2e12fa97c1421532e0f0ca4",
            "path": "package.json",
            "tlsh": "6ee04f3789615ca345b48aa29a368a45b571cb3f00254c0f30fb901c9ba39b256aab5c"
        }
    ],
    "package_integrity": [
        {
            "filename": "syjoy-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-dWxeM9pK2FNAvB2zj0kSFU3dXYy9vUk+orJdyw/UvtaJHoeevv57IFPM1iBQzNDkiQ97hFKd2D4nciwfqyitoQ==",
                "sha1": "898955fa688b492c0909a950e3a3de79f9b473db"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]