nibra1

{"modified":"2026-08-19T07:48:46Z","published":"2026-08-19T07:48:46Z","schema_version":"1.7.4","id":"MAL-2026-14284","summary":"Malicious code in nibra1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee)\nThe package's CLI entry (index.js) launches a Python payload (pointer.py) that registers global keyboard hooks, polls the clipboard, captures screenshots (mss / PIL.ImageGrab), and walks UI-Automation trees to extract on-screen text. Captured content is POSTed to the hardcoded endpoint https://iq-sec.vercel.app/api, which the installer never configured. Responses from that endpoint drive pyautogui / keyboard keystroke synthesis on the installer's host (force_paste bound to alt+v, mash-mode typing loops), turning server-controlled text into local keyboard input in the active window. To run the payload, index.js first attempts `winget install Python.Python.3.12 --silent`; on failure it silently downloads the python.org 3.12.3 Windows installer to %TEMP% and executes it with `/quiet InstallAllUsers=0 PrependPath=1` under `stdio: 'ignore'`, with in-source comments describing this as a 'Ghost Installer' with 'No UI, No Admin Popup'. A bundled start_tool.vbs uses Shell.Application.ShellExecute with window state 0 to launch pointer.py hidden in the background. The Python payload also constructs stealth Tk windows (empty titles, transparent overlays, overrideredirect) to hide its runtime UI.\n","affected":[{"package":{"ecosystem":"npm","name":"nibra1"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"pointer.py","sha256":"01ae88f6fcd21d909396e7189f67fc5f5d4accc4891de45644659dcf5b5b79e0","tlsh":"cde2fa09ec0d0896c473de2e5852b857fb1e0b435a1e9e17f8bc99901f743428ae0ef9"},{"path":"index.js","sha256":"f9918a3925f7dfc03976523f6cd3a7f1f2e1d85846f44ef3510d0a23bfe5e978","tlsh":"fb814f065a95a234ed7247a99b07212be517a0a3a100e69cbdbe83850f76945c073fee"},{"path":"start_tool.vbs","sha256":"cf43836fe86d962b0ddac5fea7fa885fd620104a01f4e624a40af9503fb8054f","tlsh":"c4f0204f42bdc81be057417253868c2de2b3d3507021d519adb8f889210c0f0897339b"}],"package_integrity":[{"filename":"nibra1-1.0.0.tgz","hashes":{"sha1":"849b1ee7f9b23e9ec630a2882de977d2602c7a94","sha512_sri":"sha512-DLxlIkhrp63x9mwmUIr76qXOykK/yiWQdBfQgSbY4GyWzpBRcgU2i9KlFfAXchX+eyC1KGZPuz2Ur1FSmHJ6Gw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nibra1/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018393","import_time":"2026-08-19T08:15:31.79895561Z","modified_time":"2026-08-19T07:48:46Z","sha256":"4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee","source":"amazon-inspector","versions":["1.0.0"]}]}}