Malicious code in nodeberlin (npm)
The npm package nodeberlin contained malicious code that captured clipboard contents and screenshots, exfiltrating them to a hardcoded attacker-controlled endpoint. The package auto-downloaded Python dependencies and established global hotkeys for screen capture and data relay.
- Disclosed
- Last updated
- Blast radius
- All npm package installers of nodeberlin
- Ecosystems
- Attack vectors
- Affected entities
- nodeberlinnpm package containing malicious code
The npm package nodeberlin was found to contain malicious code designed to exfiltrate sensitive user data. Upon installation and first run, the package's CLI binary polls the system clipboard every 300 milliseconds and captures full-desktop or user-selected screen regions.\n\nCaptured data—including clipboard contents and screenshots—is serialized as JSON text and base64-encoded JPEG images, then POSTed to a hardcoded attacker-controlled endpoint at https://tokyoap.vercel.app/api. This endpoint is not configurable by users and no API key is required, meaning all clipboard and screenshot data from every installer is automatically routed through the attacker's proxy.\n\nOn first execution, the binary auto-downloads the Python.org installer and uses pip to install keyboard, pyautogui, pillow, pyperclip, and requests libraries to support global hotkeys, screen capture, and data relay functionality. A panic-exit hotkey and stealth overlay are included to facilitate covert operation.\n\nClipboard buffers and screenshots routinely contain credentials, private messages, API keys, and other highly sensitive material, making this a critical threat to all users who installed the package.
Indicators of compromise
- Packages
- nodeberlin
- Domains
- tokyoap.vercel.app
Remediation
- Immediately uninstall the nodeberlin package from all systems
- Revoke any credentials, API keys, or sensitive information that may have been exposed via clipboard or screenshots
- Audit system logs for evidence of Python installation and the presence of keyboard, pyautogui, pillow, pyperclip, and requests libraries
- Monitor network traffic for connections to https://tokyoap.vercel.app/api
- Review npm audit logs to identify when nodeberlin was installed
- Consider full system scan for persistence mechanisms or additional malware
Sources
- GitHub Advisory GHSA-jrrx-jxq2-v5jq · GitHub Advisory Database
Cite this entry
"Malicious code in nodeberlin (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-nodeberlin-npm-l6gzn0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit