Malicious code in syboy (npm)

The npm package syboy was found to contain malicious code designed to compromise Windows systems. Upon invocation, the package's index.js spawned a VBS script via wscript.exe that escalated privileges and launched a hidden Python script (pointer.py) with Administrator rights.\n\nThe pointer.py script performed extensive surveillance and data theft: it continuously read the clipboard, captured screenshots using mss/ImageGrab, walked the UI accessibility tree of foreground windows via uiautomation, and installed global keyboard hotkeys via the keyboard module. All collected data—clipboard contents, screen captures, and UI information—was exfiltrated via POST requests to a hardcoded attacker-controlled endpoint at https://iq-overlay-pointer.vercel.app/api.\n\nThe malicious code also included a persistence mechanism: index.js downloaded the official Python 3.12.3 installer from python.org and executed it silently as a fallback when winget was unavailable. A hidden Tk overlay window was rendered to avoid user detection and screen-sharing visibility.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.