MAL-2026-6406

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/syspo/MAL-2026-6406.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6406
Published
2026-06-24T22:18:31Z
Modified
2026-08-19T00:30:14Z
Summary
Malicious code in syspo (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6e90cf048bcfbc5fcc4108def74bee85be749c8f388aa2b93b4281af3808a2a1)

Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveillance dropper. On invocation, index.js silently installs a Python 3.12 runtime (via winget or by curling https://www.python.org/ftp/python/3.12.3/python-3.12.3-amd64.exe to %TEMP% and running it with /quiet InstallAllUsers=0 PrependPath=1) and pip-installs a surveillance toolchain (pyperclip, keyboard, requests, pillow, mss, pyautogui, pywin32, uiautomation, comtypes). A bundled start_tool.vbs is then launched detached with windowsHide, invoking Shell.Application.ShellExecute with verb 'runas' and windowStyle 0 to run cmd /c cd /d <dir> && python pointer.py elevated and with no visible window. pointer.py registers global keyboard hotkeys, captures screen regions with mss and PIL.ImageGrab, walks the foreground window's UIAutomation tree to extract text from EditControls, TextPattern DocumentRange, and LegacyIAccessiblePattern (routinely capturing browser fields, password inputs, and arbitrary application text), base64-encodes screenshots, and POSTs the harvested data via requests.Session to the hardcoded endpoint https://new-pointer.vercel.app/api which the installer did not configure. Source comments explicitly label the stages 'GHOST INSTALLER', 'VBSCRIPT STEALTH MODE', and 'HACK 1/2'. Transparent topmost tk windows with blank titles, overrideredirect, and 1x1 dot labels are used to hide the running surveillance UI from the user.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-007446",
            "import_time": "2026-06-24T22:32:48.50051046Z",
            "modified_time": "2026-06-24T22:18:31Z",
            "sha256": "6f89c590b7c90182cb86bc3e45f71f2357003f4359b6e94818fc996951762f5c",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010878",
            "import_time": "2026-07-28T14:19:57.120777749Z",
            "modified_time": "2026-07-28T13:30:42Z",
            "sha256": "fbbc3c818ac60904428b280a60e6783a185a7fb00ef9c4f88c917426f2fca744",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-014737",
            "import_time": "2026-08-05T13:08:42.22645301Z",
            "modified_time": "2026-08-05T12:38:06Z",
            "sha256": "a71d0860e02e48cbb25260208399f44cd0ce1c30dc34557ed0dd74460db5fb0f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017646",
            "import_time": "2026-08-13T17:24:45.841776966Z",
            "modified_time": "2026-08-13T17:17:21Z",
            "sha256": "fb7a5e26944b2ef77f980764c721329874d9485147bcb1cba37471fb00ebdc02",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-018249",
            "import_time": "2026-08-19T00:21:12.95635586Z",
            "modified_time": "2026-08-18T23:59:06Z",
            "sha256": "6e90cf048bcfbc5fcc4108def74bee85be749c8f388aa2b93b4281af3808a2a1",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / syspo

Package

Name
syspo
View open source insights on deps.dev
Purl
pkg:npm/syspo

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "pointer.py",
            "sha256": "371774d6ebf4d4e28659c69390d5436666750eaac8c8a704161d6757d85c86c6",
            "tlsh": "8af22e09ec1c089ac073cd2f5952a853ff1a07439a5eda17f8bc99901f743468ae4ef9"
        },
        {
            "path": "index.js",
            "sha256": "dd63a58755fb0ff2919a9debd8e6adb710a9f755454c10e766920dec788c4c33",
            "tlsh": "69814f065a95a234ed7247a99b07212be517a063a100e69cbdbe83840f76945c073fee"
        },
        {
            "path": "package.json",
            "sha256": "2ee8c935c832a1450d47818b8a30c1d50e93731d0332937a29b5364ece78ef94",
            "tlsh": "e5e04f33c9615ca344b58aa29a368a05b5b18b3f00254c0f30bb501c97a29a245bab6c"
        }
    ],
    "package_integrity": [
        {
            "filename": "syspo-1.0.0.tgz",
            "hashes": {
                "sha1": "a19e372a1c6f7b7a9c4704254a108d6eddbbda35",
                "sha512_sri": "sha512-cjZ+w12qnV0dJY1UfDC5MXXwqpQvXEa+k92yLWeUhcW9Sa08v5WIVVaNRQLjbyytoR3txRmpGjY2pD3VwddRMA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/syspo/MAL-2026-6406.json"