MAL-2026-6405

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sypoi1/MAL-2026-6405.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6405
Published
2026-06-24T22:18:30Z
Modified
2026-07-01T21:16:41.578782894Z
Summary
Malicious code in sypoi1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b22a9450e70ba1095097d2779ad6da01c111c37e940d890fbfc21d1aeb6a0f11)

On require, index.js silently bootstraps a full Python runtime on the installer's machine — first via winget install -e --id Python.Python.3.12 --silent, falling back to downloading python-3.12.3-amd64.exe from python.org and executing it with /quiet InstallAllUsers=0 PrependPath=1 — then silently pip installs pyautogui, keyboard, mss, pillow, pyperclip, and uiautomation. It then spawns pointer.py, which installs system-wide hotkeys (Ctrl+C, Alt+S, F8/F9/F10, Alt+M, Ctrl+Q), creates a topmost transparent always-on-top Tk window using overrideredirect(True) to hide from the user, continuously monitors clipboard contents, and on hotkeys captures full-monitor screenshots and on-screen text via UI Automation. Captured clipboard text and base64-encoded screenshots are POSTed to a hardcoded destination at https://iq-overlay-pointer.vercel.app/api. The agent also exposes a mash_callback mode that hooks keyboard.on_press with suppress=True and substitutes attacker-supplied characters via pyautogui.write(char), injecting keystrokes into whatever window is focused. The package's declared purpose — "System binary configuration tool" by author "SysDev" with keywords system/binary/util/config — does not match any of this behavior; the metadata is a cover story for a screen/clipboard surveillance and remote-keystroke-injection agent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "b22a9450e70ba1095097d2779ad6da01c111c37e940d890fbfc21d1aeb6a0f11",
            "modified_time": "2026-06-24T22:18:30Z",
            "source": "amazon-inspector",
            "import_time": "2026-06-24T22:32:48.281524075Z",
            "id": "IN-MAL-2026-007444"
        },
        {
            "versions": [
                "1.0.1"
            ],
            "sha256": "3915c6ac9deb9f7d6d26939bb46fbe5782646d9f146fea26ad1da3a05ef7dbae",
            "modified_time": "2026-07-01T20:48:32Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007902",
            "import_time": "2026-07-01T21:04:21.066513892Z"
        }
    ]
}
References
Credits

Affected packages

npm / sypoi1

Package

Name
sypoi1
View open source insights on deps.dev
Purl
pkg:npm/sypoi1

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "sypoi1-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-aFJobp2UJW5C+ydadABTeY42YsjxpB+f3NqZgIvpZ+UYBespExyALtR4F6TIkp/aKE51b9jYfqHMy13JACNAYw==",
                "sha1": "319d5cee242c0e942307560d75a9265d4bc19345"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "a095aa6a4b08da23c6f2267bc18fe5f47342a3fa3225309796f54e1935f43207",
            "path": "pointer.py",
            "tlsh": "4af22e09ec1d089ac073cd2f5952a853ff1a07439a5eda17f8bc99901f743468ae4ef9"
        },
        {
            "sha256": "dd63a58755fb0ff2919a9debd8e6adb710a9f755454c10e766920dec788c4c33",
            "path": "index.js",
            "tlsh": "69814f065a95a234ed7247a99b07212be517a063a100e69cbdbe83840f76945c073fee"
        },
        {
            "sha256": "2dca436bcfa80b415c6742292f0f34e21fdf0685931458b1b83d5cf2f084848f",
            "path": "package.json",
            "tlsh": "dfe04f338d655c9344b48aa29a368a15f5718b3f10254c0f30bb511c97a29b245bab6c"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sypoi1/MAL-2026-6405.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]