Malicious code in bqq1 (npm)
The npm package bqq1 contained malicious code that silently installs Python 3.12, executes a remote-control payload (pointer.py), and exfiltrates keyboard input, clipboard data, and screen captures to a hardcoded endpoint. The package was designed with stealth mechanisms including hidden UI windows and hotkey-driven remote command execution.
- Disclosed
- Last updated
- Blast radius
- npm package registry; Windows systems with Node.js
- Ecosystems
- Attack vectors
- Affected entities
- bqq1npm package advertised as 'System binary configuration tool'
The npm package bqq1, advertised as a 'System binary configuration tool', shipped with a covert surveillance and remote-control payload. Upon require/start, the package's index.js unconditionally executes startApp(), which silently installs Python 3.12 via winget or by downloading and running the python.org MSI installer to %TEMP% with quiet flags, then globally pip-installs a fixed dependency list.
The malicious payload (pointer.py) installs global keyboard hooks, reads clipboard data via pyperclip, captures screen regions using mss and PIL ImageGrab, and scrapes text from other applications' UI via Windows UIAutomation tree walking. All captured data is POSTed to the hardcoded endpoint https://iq-sec.vercel.app/api.
The remote control mechanism uses pyautogui to type attacker-controlled text into the focused window, driven by global hotkeys (trigger_api, force_paste, retry_api). The UI runs in borderless Tk windows with blank titles, override-redirect, and transparent overlays, with explicit 'stealth_hide' and 'panic_exit' hotkeys—engineering that directly contradicts the package's declared purpose.
The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- bqq1
- Domains
- iq-sec.vercel.app
Remediation
- Immediately uninstall bqq1 from all affected systems
- Audit npm package.json and node_modules for any presence of bqq1
- Review system logs for unexpected Python 3.12 installations or pyautogui/pointer.py execution
- Check for unauthorized keyboard hooks, clipboard access, or screen capture activity
- Rotate credentials and review clipboard history for sensitive data exposure
- Monitor network traffic to iq-sec.vercel.app and block the domain
- Scan systems for remnants of Python 3.12 and associated malicious dependencies installed via pip
- Update npm dependencies and use npm audit to identify similar malicious packages
Sources
- GitHub Advisory GHSA-m9cj-5h6r-p745 · GitHub Advisory Database
Cite this entry
"Malicious code in bqq1 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-bqq1-npm-kqki37
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package