sysdo

{"modified":"2026-08-19T02:50:52Z","published":"2026-08-19T02:50:52Z","schema_version":"1.7.4","id":"MAL-2026-14215","summary":"Malicious code in sysdo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33)\nThe package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers global keyboard hooks and hotkeys, captures clipboard contents via pyperclip, takes screenshots via mss/ImageGrab, and walks UI-automation trees to extract on-screen text, then POSTs the captured data to the hardcoded endpoint https://iq-sec.vercel.app/api which the installer did not configure. It creates borderless topmost windows with empty titles and a 'panic_exit' hotkey, and can inject text back into the active window via pyautogui, giving covert operator-assist capability on the installer's host. The npm entry point (index.js, invoked via the bin/start script) silently installs Python by first attempting winget and then downloading the python.org 3.12.3 installer to %TEMP% and running it with /quiet flags in comments explicitly framed as a 'Ghost Install (No UI, No Admin Popup)', and pip-installs the surveillance stack (pyperclip, keyboard, mss, pyautogui, pywin32, uiautomation). A bundled start_tool.vbs uses Shell.Application.ShellExecute with a hidden window (mode 0) to launch cmd.exe running pointer.py without a visible console. The declared purpose does not match the observed behavior, and the exfiltration destination is a hardcoded author endpoint rather than any installer-configurable target.\n","affected":[{"package":{"ecosystem":"npm","name":"sysdo"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"pointer.py","sha256":"a2518602eab0c7fe58c10ad5d6350f5d47fd68487a2bb46a179df4b115cafdb9","tlsh":"38e2ea09ec4d0896c473de2e5852a857fb1e0b435a1e9e17f8bc99901f743428ae4ef9"},{"path":"index.js","sha256":"dd63a58755fb0ff2919a9debd8e6adb710a9f755454c10e766920dec788c4c33","tlsh":"69814f065a95a234ed7247a99b07212be517a063a100e69cbdbe83840f76945c073fee"},{"path":"start_tool.vbs","sha256":"cf43836fe86d962b0ddac5fea7fa885fd620104a01f4e624a40af9503fb8054f","tlsh":"c4f0204f42bdc81be057417253868c2de2b3d3507021d519adb8f889210c0f0897339b"}],"package_integrity":[{"filename":"sysdo-1.0.0.tgz","hashes":{"sha1":"48397440ccbc89b4313ccf1d3d937bc88757ca90","sha512_sri":"sha512-T4fYwCfCtd7X1KstjscgV8BXZAfFvWEr5JdgN+grc6D8r7wnM3ZLze/6KzreN2NSzLxTxeqZEm2766vDdtFwuQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sysdo/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018308","import_time":"2026-08-19T02:57:22.880568622Z","modified_time":"2026-08-19T02:50:52Z","sha256":"bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33","source":"amazon-inspector","versions":["1.0.0"]}]}}