Malicious code in sysbin (npm)
The npm package sysbin contains malicious code that executes a Python stealth overlay (pointer.py) on installation or require(), exfiltrating clipboard contents and screenshots to a hardcoded attacker endpoint. The package includes a 'ghost installer' that silently installs Python if absent, bypassing user prompts.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installs or requires the sysbin npm package; systems with Python installed or that allow silent installation of Python; clipboard and screenshot data exfiltration to attacker-controlled endpoint.
- Ecosystems
- Attack vectors
- Affected entities
- sysbinnpm package advertised as 'System binary configuration tool' but containing malicious Python overlay
The npm package sysbin was published with malicious code disguised as a system configuration tool. When the package is installed or required, index.js unconditionally calls startApp(), which triggers execution of an embedded Python script (pointer.py) designed for data exfiltration and surveillance.\n\nThe malicious overlay includes a 'ghost installer' mechanism that automatically installs Python 3.12.3 if not present, using silent installation flags and downloading the installer directly to %TEMP% to bypass browser and admin prompts. It then pip-installs surveillance dependencies (pyperclip, keyboard, mss, pyautogui, pywin32, uiautomation) and launches pointer.py.\n\npointer.py implements clipboard monitoring (polling every 300ms via pyperclip.paste()) and screenshot capture (via mss/ImageGrab hotkeys), base64-encoding and POSTing all captured data to the hardcoded endpoint https://iq-overlay-pointer.vercel.app/api. The endpoint is hardcoded with no configuration surface, documentation, or user consent mechanism. Additional stealth features include panic exit on Ctrl+Q, hidden transparent windows, and keystroke-replay functionality, confirming the tool is designed for covert surveillance.\n\nThe package was identified by Amazon Inspector and reported via GitHub Advisory GHSA-jxmp-2j7x-rvwp.
Indicators of compromise
- Packages
- sysbin
- Domains
- iq-overlay-pointer.vercel.app
- Hashes
- 8ab8ea4ce073a93a1973a062ac7661ceeaea9c312f9fd67e9acda9936e2b6578
Remediation
- Immediately uninstall sysbin from all systems: npm uninstall sysbin
- Audit npm package.json and lock files for any direct or transitive dependencies on sysbin
- Review system logs and process execution history for evidence of Python installation or pointer.py execution
- Scan systems for the presence of pointer.py and the Python 3.12.3 installer in %TEMP%
- Monitor for suspicious outbound connections to iq-overlay-pointer.vercel.app and related domains
- Assume clipboard and screenshot data may have been exfiltrated; rotate sensitive credentials and review clipboard history
- Block the endpoint https://iq-overlay-pointer.vercel.app/api at the network level
- Review npm audit logs and consider enabling 2FA and package signing verification on npm accounts
Sources
- GitHub Advisory GHSA-jxmp-2j7x-rvwp · GitHub Advisory Database
Cite this entry
"Malicious code in sysbin (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-sysbin-npm-w4kv7g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in edu-npm-dependency-chain-demo
Malware discovered in the npm package edu-npm-dependency-chain-demo. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in roblox-api-client
Malware was discovered in the npm package roblox-api-client, resulting in full system compromise for any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in jextic-eclib
Malware was discovered in the npm package jextic-eclib, resulting in full system compromise of any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in @thone33/analytics-injector
Malware discovered in the npm package @thone33/analytics-injector. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package