{"id":"MAL-2026-4678","summary":"Malicious code in sysnode (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b1f5d271eb72dffa8868b2701aeb4aa7799ee9d7294f342e14682b6675114077)\nPackage self-describes as a 'System binary configuration tool' but on invocation (CLI/bin entry or require) it silently bootstraps a full surveillance stack on Windows. index.js:42-47 uses winget and, as fallback, curls https://www.python.org/ftp/python/3.12.3/python-3.12.3-amd64.exe to %TEMP% and runs the installer with /quiet InstallAllUsers=0 PrependPath=1 to avoid UAC and any visible UI. It then pip-installs `keyboard`, `pyperclip`, `mss`, `pyautogui`, `uiautomation`, and `comtypes` — the canonical keylogger / clipboard-scrape / screen-capture / UI-automation library set — and spawns a pyarmor 9.2.4 trial-encrypted `pointer.py` (loaded via `pyarmor_runtime_000000.__pyarmor__` from a 624 KB native.pyd) with shell:false and a comment explicitly noting the goal of running without a CMD window. The actual capture/exfil logic is hidden inside the pyarmor blob and cannot be reviewed. The package's stated purpose, generic keywords, and placeholder author 'ABC' do not match observed behavior — a cover story for a Windows surveillance dropper.\n","modified":"2026-05-26T06:02:57.299384301Z","published":"2026-05-24T18:05:02Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.25"],"id":"IN-MAL-2026-004522","import_time":"2026-05-26T05:52:46.174976594Z","modified_time":"2026-05-24T18:05:02Z","sha256":"b1f5d271eb72dffa8868b2701aeb4aa7799ee9d7294f342e14682b6675114077"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sysnode/v/1.0.25"}],"affected":[{"package":{"name":"sysnode","ecosystem":"npm","purl":"pkg:npm/sysnode"},"versions":["1.0.25"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"1056e5b51a969a6773b20f0b94a58aa57e505cd2","sha512_sri":"sha512-mSUMhjKUiEVFLi3RSW8cX3OUuB6jpHzb5LcJscWTlz1IS/oQLYK1KhCvGINWmmQnPR+2mFEcsMWw0PGYKFkjrA=="},"filename":"sysnode-1.0.25.tgz"}],"evidence_files":[{"tlsh":"69814f065a95a234ed7247a99b07212be517a063a100e69cbdbe83840f76945c073fee","path":"index.js","sha256":"dd63a58755fb0ff2919a9debd8e6adb710a9f755454c10e766920dec788c4c33"},{"path":"pointer.py","sha256":"6f36e3d910f7eb35b4c10e46fa97246af10576a8acb9e6719124247e82cf3839","tlsh":"80f397845622e17e5b97ce192f43aedc2869d9efc4c9e701f0845a4fe0a873c94e57c2"},{"path":"package.json","sha256":"773c8dafec7f0902c93e845c4968690c5712e13f4d0771d903521b49d395a752","tlsh":"06e0863399715d9344f44aa29a2b5b19b1728f7f00354c0f30fb505c97f2ab245bab1c"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sysnode/MAL-2026-4678.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}