MAL-2026-14284

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nibra1/MAL-2026-14284.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14284
Published
2026-08-19T07:48:46Z
Modified
2026-08-19T08:34:49.580948545Z
Summary
Malicious code in nibra1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee)

The package's CLI entry (index.js) launches a Python payload (pointer.py) that registers global keyboard hooks, polls the clipboard, captures screenshots (mss / PIL.ImageGrab), and walks UI-Automation trees to extract on-screen text. Captured content is POSTed to the hardcoded endpoint https://iq-sec.vercel.app/api, which the installer never configured. Responses from that endpoint drive pyautogui / keyboard keystroke synthesis on the installer's host (forcepaste bound to alt+v, mash-mode typing loops), turning server-controlled text into local keyboard input in the active window. To run the payload, index.js first attempts winget install Python.Python.3.12 --silent; on failure it silently downloads the python.org 3.12.3 Windows installer to %TEMP% and executes it with /quiet InstallAllUsers=0 PrependPath=1 under stdio: 'ignore', with in-source comments describing this as a 'Ghost Installer' with 'No UI, No Admin Popup'. A bundled starttool.vbs uses Shell.Application.ShellExecute with window state 0 to launch pointer.py hidden in the background. The Python payload also constructs stealth Tk windows (empty titles, transparent overlays, overrideredirect) to hide its runtime UI.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T08:15:31.79895561Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T07:48:46Z",
            "sha256": "4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee",
            "id": "IN-MAL-2026-018393",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / nibra1

Package

Name
nibra1
View open source insights on deps.dev
Purl
pkg:npm/nibra1

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nibra1/MAL-2026-14284.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "01ae88f6fcd21d909396e7189f67fc5f5d4accc4891de45644659dcf5b5b79e0",
            "tlsh": "cde2fa09ec0d0896c473de2e5852b857fb1e0b435a1e9e17f8bc99901f743428ae0ef9",
            "path": "pointer.py"
        },
        {
            "sha256": "f9918a3925f7dfc03976523f6cd3a7f1f2e1d85846f44ef3510d0a23bfe5e978",
            "tlsh": "fb814f065a95a234ed7247a99b07212be517a0a3a100e69cbdbe83850f76945c073fee",
            "path": "index.js"
        },
        {
            "sha256": "cf43836fe86d962b0ddac5fea7fa885fd620104a01f4e624a40af9503fb8054f",
            "path": "start_tool.vbs",
            "tlsh": "c4f0204f42bdc81be057417253868c2de2b3d3507021d519adb8f889210c0f0897339b"
        }
    ],
    "package_integrity": [
        {
            "filename": "nibra1-1.0.0.tgz",
            "hashes": {
                "sha1": "849b1ee7f9b23e9ec630a2882de977d2602c7a94",
                "sha512_sri": "sha512-DLxlIkhrp63x9mwmUIr76qXOykK/yiWQdBfQgSbY4GyWzpBRcgU2i9KlFfAXchX+eyC1KGZPuz2Ur1FSmHJ6Gw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]