sysau

{"modified":"2026-06-24T22:34:40Z","published":"2026-06-11T06:49:34Z","schema_version":"1.7.4","id":"MAL-2026-5615","summary":"Malicious code in sysau (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2b9246e768a775d54485e7208d0ed4fc575af09bc78c3fde95c5cb24ebc2350d)\nPackage advertises itself as a 'System binary configuration tool' but ships pointer.py (spawned by index.js) which hardcodes VERCEL_API_URL='https://iq-overlay-pointer.vercel.app/api' and continuously transmits installer-side data to that endpoint. A monitor loop polls the system clipboard every 300ms and POSTs changes; the alt+s hotkey captures the full screen via mss/ImageGrab and uploads base64 image data; F8/F9/F10 hotkeys use the Windows UI Automation API (uiautomation library) to walk the control tree of arbitrary foreground applications (browsers, IDEs, email clients), extract Edit/Text/Document control values (including IAccessible2 Legacy patterns), and route them to the same endpoint via the clipboard channel. To enable this on machines without Python, index.js silently installs a Python runtime — first attempting winget --silent, then falling back to downloading python-3.12.3-amd64.exe from python.org to %TEMP% and executing it with `/quiet InstallAllUsers=0 PrependPath=1` (comments in the script describe this as 'GHOST INSTALLER... No UI, No Admin Popup'). It then pip-installs keyboard, pyautogui, mss, uiautomation, pywin32, and others before spawning pointer.py. pointer.py also installs system-wide keyboard hooks with keystroke suppression (`keyboard.on_press(..., suppress=True)`) and renders a 75%-alpha, overrideredirect, transparent-color tk overlay window labelled '.' — a stealth UI consistent with a covert surveillance/interview-cheating overlay rather than the advertised binary configuration utility. None of this behavior is disclosed in the package metadata.\n","affected":[{"package":{"ecosystem":"npm","name":"sysau"},"versions":["1.0.0","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"pointer.py","sha256":"593e023110c09051c715e85251b59f93962cd3e136f26fbce3a6182fd0276b8d","tlsh":"caf23e09ec1c189ac073ce1f5952a853fb1a07435b5eda17f8bc99902f743468ae4ef9"},{"path":"index.js","sha256":"dd63a58755fb0ff2919a9debd8e6adb710a9f755454c10e766920dec788c4c33","tlsh":"69814f065a95a234ed7247a99b07212be517a063a100e69cbdbe83840f76945c073fee"},{"path":"package.json","sha256":"3086edaf7571e07dae429dfdb9b8a5cbc513058d97cf7d76a118e17cf0333eae","tlsh":"89e04f3389615ca345b44aa29a368a09b5728b3f00254c0f30bb901c97a29a345bab5c"}],"package_integrity":[{"filename":"sysau-1.0.3.tgz","hashes":{"sha1":"a7ac1464bce9347c5f757cb5ee6c32a315c6bcec","sha512_sri":"sha512-pOONx8aJzTWPvWJHi60gPZEy8Hk5hbUkW4FSMGW3lb/qHLHGKG8bXCSIAHFAb6IcbClqKsDol78K6FQtHY3nnA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sysau/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sysau/v/1.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"4b2cf08a271605de33b2c202bb8a5a6689251e9a4711a628a88c57ebf0ec4f07","import_time":"2026-06-11T07:49:37.365147343Z","id":"IN-MAL-2026-005653","modified_time":"2026-06-11T06:49:34Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"2b9246e768a775d54485e7208d0ed4fc575af09bc78c3fde95c5cb24ebc2350d","import_time":"2026-06-24T22:32:48.109808254Z","id":"IN-MAL-2026-007443","modified_time":"2026-06-24T22:18:27Z","versions":["1.0.3"]}]}}