MAL-2026-14215

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sysdo/MAL-2026-14215.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14215
Published
2026-08-19T02:50:52Z
Modified
2026-08-19T03:00:14.234173265Z
Summary
Malicious code in sysdo (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33)

The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers global keyboard hooks and hotkeys, captures clipboard contents via pyperclip, takes screenshots via mss/ImageGrab, and walks UI-automation trees to extract on-screen text, then POSTs the captured data to the hardcoded endpoint https://iq-sec.vercel.app/api which the installer did not configure. It creates borderless topmost windows with empty titles and a 'panicexit' hotkey, and can inject text back into the active window via pyautogui, giving covert operator-assist capability on the installer's host. The npm entry point (index.js, invoked via the bin/start script) silently installs Python by first attempting winget and then downloading the python.org 3.12.3 installer to %TEMP% and running it with /quiet flags in comments explicitly framed as a 'Ghost Install (No UI, No Admin Popup)', and pip-installs the surveillance stack (pyperclip, keyboard, mss, pyautogui, pywin32, uiautomation). A bundled starttool.vbs uses Shell.Application.ShellExecute with a hidden window (mode 0) to launch cmd.exe running pointer.py without a visible console. The declared purpose does not match the observed behavior, and the exfiltration destination is a hardcoded author endpoint rather than any installer-configurable target.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T02:57:22.880568622Z",
            "sha256": "bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33",
            "modified_time": "2026-08-19T02:50:52Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018308",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sysdo

Package

Name
sysdo
View open source insights on deps.dev
Purl
pkg:npm/sysdo

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sysdo/MAL-2026-14215.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "a2518602eab0c7fe58c10ad5d6350f5d47fd68487a2bb46a179df4b115cafdb9",
            "path": "pointer.py",
            "tlsh": "38e2ea09ec4d0896c473de2e5852a857fb1e0b435a1e9e17f8bc99901f743428ae4ef9"
        },
        {
            "sha256": "dd63a58755fb0ff2919a9debd8e6adb710a9f755454c10e766920dec788c4c33",
            "path": "index.js",
            "tlsh": "69814f065a95a234ed7247a99b07212be517a063a100e69cbdbe83840f76945c073fee"
        },
        {
            "sha256": "cf43836fe86d962b0ddac5fea7fa885fd620104a01f4e624a40af9503fb8054f",
            "tlsh": "c4f0204f42bdc81be057417253868c2de2b3d3507021d519adb8f889210c0f0897339b",
            "path": "start_tool.vbs"
        }
    ],
    "package_integrity": [
        {
            "filename": "sysdo-1.0.0.tgz",
            "hashes": {
                "sha1": "48397440ccbc89b4313ccf1d3d937bc88757ca90",
                "sha512_sri": "sha512-T4fYwCfCtd7X1KstjscgV8BXZAfFvWEr5JdgN+grc6D8r7wnM3ZLze/6KzreN2NSzLxTxeqZEm2766vDdtFwuQ=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]