{"id":"MAL-2026-5897","summary":"Malicious code in noderzero (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f9fa08be36ae12861809af052871d79536e7ed601c90bb2cff80fa0371e2c4ce)\nnoderzero is a self-described 'stealth assistant' that exfiltrates clipboard contents and full-screen screenshots to a hardcoded author-controlled endpoint. client/noderzero.py defines `API_URL = 'https://noderzero.vercel.app/api'` and (a) polls `pyperclip.paste()` every 300ms, POSTing every change to that URL as `{text:...}`, and (b) on hotkey captures full-screen images via `PIL.ImageGrab.grab()`, base64-encodes them, and POSTs them to the same URL. The destination is fixed in source — the user cannot redirect or disable it. The Python tool is not optional: launcher.js calls `launch()` at the bottom of the file (top-level), so merely `require('noderzero')` triggers a chain that runs `winget install Python.Python.3.12 --silent` or downloads python-3.12.3-amd64.exe from python.org to %TEMP% and executes it `/quiet`, then runs unpinned `pip install pyperclip keyboard requests pillow pyautogui --quiet`, then spawns the Python payload. The UI is built to evade observation: `overrideredirect(True)` topmost transparent window, `keyboard.add_hotkey('ctrl+q', self.panic_exit)`, `keyboard.on_press(suppress=True)`, and pyautogui-driven human-like typing. The combination of stealth UI, global keyboard hooks, clipboard scraping, screen capture, and hardcoded outbound POSTs is a surveillance/keylogger-grade exfiltrator with attacker-benefit (all captured data flows to the author's endpoint).\n","modified":"2026-06-16T16:16:48.290049335Z","published":"2026-06-16T15:29:12Z","database_specific":{"malicious-packages-origins":[{"sha256":"20cc131b4ac008bdd52a408fdc384362040cc3af59d33bef5ed26a7bbb12c9a0","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-006761","import_time":"2026-06-16T16:06:33.919845977Z","modified_time":"2026-06-16T15:29:23Z"},{"versions":["1.0.2"],"id":"IN-MAL-2026-006758","import_time":"2026-06-16T16:06:33.643625805Z","modified_time":"2026-06-16T15:29:12Z","sha256":"f9fa08be36ae12861809af052871d79536e7ed601c90bb2cff80fa0371e2c4ce","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-006759","import_time":"2026-06-16T16:06:33.738811477Z","modified_time":"2026-06-16T15:29:17Z","sha256":"77f04f5a70d5a2bc06e943b3e39979f82c25452cf962db59b10e8f772d936002"},{"versions":["1.0.3"],"id":"IN-MAL-2026-006760","import_time":"2026-06-16T16:06:33.831417223Z","modified_time":"2026-06-16T15:29:17Z","sha256":"d396fe60e1b017899f271a36f6b803adde50338ee1bd55fda728d5dded59f787","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/noderzero/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/noderzero/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/noderzero/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/noderzero/v/1.0.3"}],"affected":[{"package":{"name":"noderzero","ecosystem":"npm","purl":"pkg:npm/noderzero"},"versions":["1.0.1","1.0.2","1.0.5","1.0.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/noderzero/MAL-2026-5897.json","indicators":{"evidence_files":[{"path":"client/noderzero.py","sha256":"9f4b340c798bf5f85d990d8cbfc02b696f703c941edbc258671bbcb7792b39fc","tlsh":"4db2fb75a0085859fa63dc1e89a6b5133e1f3e437a4c9528bcbcb9911fcc32684e1ef0"},{"path":"launcher.js","sha256":"bb7c87a63cb5c2bade2ba79b9a5ab9e186a3377c0f82b777ea3accd82abb3071","tlsh":"6971dd7605f55334b862d29ddb4b51272013b0137648e9987eaeb3844fce61891b3bfa"}],"package_integrity":[{"filename":"noderzero-1.0.1.tgz","hashes":{"sha1":"6d17c59ead224cc1a2f55edc418d3b4e3822c79e","sha512_sri":"sha512-Ra9orJkax3ZZzz8+WIGRVjoVhu0LlEZFSLUhenxyBGqx5UJuFe2qP/o8nj28s2xlRWKm0TokKlShjnMjBdpnig=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}