nodetokyo

{"modified":"2026-09-22T18:06:25Z","published":"2026-09-22T18:06:25Z","schema_version":"1.7.4","id":"MAL-2026-16388","summary":"Malicious code in nodetokyo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203)\nThe package's declared main (launcher.js) executes launch() at module top level, so require('nodetokyo') automatically installs Python 3.12 (via winget or by downloading the python.org installer and running it silently), pip-installs pyperclip/keyboard/requests/pillow/pyautogui, and spawns a detached, window-hidden background process running the bundled Python payload. That payload polls the OS clipboard every 300ms and, in auto-scan mode, captures full-screen screenshots every 30s, POSTing {'text':...} and {'image': <base64>} to the hardcoded endpoint https://nodetokyo.vercel.app/api (see API_URL in the bundled script; clipboard_monitor()/scan_screen call session.post(API_URL,...)). The destination is not caller-configurable. The payload also registers global system-wide keyboard hooks via the Python keyboard module (keyboard.on_press with suppress=True; keyboard.add_hotkey('ctrl+c',...)) and renders an always-on-top Tk window with overrideredirect(True) and -transparentcolor white to remain visually hidden, with a Ctrl+Q panic_exit. Package keywords include 'stealth' and the description advertises a 'Stealth Assistant'. Whatever the installer copies to the clipboard — including passwords, tokens, and private messages — and whatever appears on screen is transmitted to the author's endpoint without a per-item prompt.\n","affected":[{"package":{"ecosystem":"npm","name":"nodetokyo"},"versions":["1.0.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"client/noderzero.py","sha256":"483cdd8305dc2d3e9f3030707787cf8f5adf0c9c4d66ff20199f8844715e0993","tlsh":"cdc2d876a0085859f663dc1f8996b5132e1e3e437a4ca528bcfcb9950fcc32685e1ef1"},{"path":"launcher.js","sha256":"cb532713f8c9e3dcf4001791df872e9457581beb90e4171fe98b196bf2e21f1f","tlsh":"2871217655e15338b962d69ddb4f51232013b013b248e8987daeb3844fce114c0b3bfa"}],"package_integrity":[{"filename":"nodetokyo-1.0.8.tgz","hashes":{"sha1":"ca9ff17c70e93737cbc6ab49e4e9a213592eafea","sha512_sri":"sha512-Zxl2tj31S5xCmGdbUa72+NOWNQBKsd5RlMVRyXsWbhxX6bckFCy42rU94hYYBqqzxKerpOUqSOPCEoJ3GBv+lw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nodetokyo/v/1.0.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020295","import_time":"2026-09-22T18:23:45.103903358Z","modified_time":"2026-09-22T18:06:25Z","sha256":"9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203","source":"amazon-inspector","versions":["1.0.8"]}]}}