MAL-2026-5615

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sysau/MAL-2026-5615.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5615
Published
2026-06-11T06:49:34Z
Modified
2026-06-24T22:46:22.799945936Z
Summary
Malicious code in sysau (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2b9246e768a775d54485e7208d0ed4fc575af09bc78c3fde95c5cb24ebc2350d)

Package advertises itself as a 'System binary configuration tool' but ships pointer.py (spawned by index.js) which hardcodes VERCELAPIURL='https://iq-overlay-pointer.vercel.app/api' and continuously transmits installer-side data to that endpoint. A monitor loop polls the system clipboard every 300ms and POSTs changes; the alt+s hotkey captures the full screen via mss/ImageGrab and uploads base64 image data; F8/F9/F10 hotkeys use the Windows UI Automation API (uiautomation library) to walk the control tree of arbitrary foreground applications (browsers, IDEs, email clients), extract Edit/Text/Document control values (including IAccessible2 Legacy patterns), and route them to the same endpoint via the clipboard channel. To enable this on machines without Python, index.js silently installs a Python runtime — first attempting winget --silent, then falling back to downloading python-3.12.3-amd64.exe from python.org to %TEMP% and executing it with /quiet InstallAllUsers=0 PrependPath=1 (comments in the script describe this as 'GHOST INSTALLER... No UI, No Admin Popup'). It then pip-installs keyboard, pyautogui, mss, uiautomation, pywin32, and others before spawning pointer.py. pointer.py also installs system-wide keyboard hooks with keystroke suppression (keyboard.on_press(..., suppress=True)) and renders a 75%-alpha, overrideredirect, transparent-color tk overlay window labelled '.' — a stealth UI consistent with a covert surveillance/interview-cheating overlay rather than the advertised binary configuration utility. None of this behavior is disclosed in the package metadata.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-11T07:49:37.365147343Z",
            "id": "IN-MAL-2026-005653",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-06-11T06:49:34Z",
            "sha256": "4b2cf08a271605de33b2c202bb8a5a6689251e9a4711a628a88c57ebf0ec4f07"
        },
        {
            "import_time": "2026-06-24T22:32:48.109808254Z",
            "id": "IN-MAL-2026-007443",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-06-24T22:18:27Z",
            "sha256": "2b9246e768a775d54485e7208d0ed4fc575af09bc78c3fde95c5cb24ebc2350d"
        }
    ]
}
References
Credits

Affected packages

npm / sysau

Package

Name
sysau
View open source insights on deps.dev
Purl
pkg:npm/sysau

Affected ranges

Affected versions

1.*
1.0.0
1.0.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sysau/MAL-2026-5615.json"
indicators 
{
    "evidence_files": [
        {
            "path": "pointer.py",
            "tlsh": "caf23e09ec1c189ac073ce1f5952a853fb1a07435b5eda17f8bc99902f743468ae4ef9",
            "sha256": "593e023110c09051c715e85251b59f93962cd3e136f26fbce3a6182fd0276b8d"
        },
        {
            "path": "index.js",
            "tlsh": "69814f065a95a234ed7247a99b07212be517a063a100e69cbdbe83840f76945c073fee",
            "sha256": "dd63a58755fb0ff2919a9debd8e6adb710a9f755454c10e766920dec788c4c33"
        },
        {
            "path": "package.json",
            "tlsh": "89e04f3389615ca345b44aa29a368a09b5728b3f00254c0f30bb901c97a29a345bab5c",
            "sha256": "3086edaf7571e07dae429dfdb9b8a5cbc513058d97cf7d76a118e17cf0333eae"
        }
    ],
    "package_integrity": [
        {
            "filename": "sysau-1.0.3.tgz",
            "hashes": {
                "sha1": "a7ac1464bce9347c5f757cb5ee6c32a315c6bcec",
                "sha512_sri": "sha512-pOONx8aJzTWPvWJHi60gPZEy8Hk5hbUkW4FSMGW3lb/qHLHGKG8bXCSIAHFAb6IcbClqKsDol78K6FQtHY3nnA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]