Malicious code in sysbin (npm)
The npm package sysbin contains malicious code that executes a Python stealth overlay (pointer.py) on installation or require(), exfiltrating clipboard contents and screenshots to a hardcoded attacker endpoint. The package includes a 'ghost installer' that silently installs Python if absent, bypassing user prompts.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installs or requires the sysbin npm package; systems with Python installed or that allow silent installation of Python; clipboard and screenshot data exfiltration to attacker-controlled endpoint.
- Ecosystems
- Attack vectors
- Affected entities
- sysbinnpm package advertised as 'System binary configuration tool' but containing malicious Python overlay
The npm package sysbin was published with malicious code disguised as a system configuration tool. When the package is installed or required, index.js unconditionally calls startApp(), which triggers execution of an embedded Python script (pointer.py) designed for data exfiltration and surveillance.\n\nThe malicious overlay includes a 'ghost installer' mechanism that automatically installs Python 3.12.3 if not present, using silent installation flags and downloading the installer directly to %TEMP% to bypass browser and admin prompts. It then pip-installs surveillance dependencies (pyperclip, keyboard, mss, pyautogui, pywin32, uiautomation) and launches pointer.py.\n\npointer.py implements clipboard monitoring (polling every 300ms via pyperclip.paste()) and screenshot capture (via mss/ImageGrab hotkeys), base64-encoding and POSTing all captured data to the hardcoded endpoint https://iq-overlay-pointer.vercel.app/api. The endpoint is hardcoded with no configuration surface, documentation, or user consent mechanism. Additional stealth features include panic exit on Ctrl+Q, hidden transparent windows, and keystroke-replay functionality, confirming the tool is designed for covert surveillance.\n\nThe package was identified by Amazon Inspector and reported via GitHub Advisory GHSA-jxmp-2j7x-rvwp.
Indicators of compromise
- Packages
- sysbin
- Domains
- iq-overlay-pointer.vercel.app
- Hashes
- 8ab8ea4ce073a93a1973a062ac7661ceeaea9c312f9fd67e9acda9936e2b6578
Remediation
- Immediately uninstall sysbin from all systems: npm uninstall sysbin
- Audit npm package.json and lock files for any direct or transitive dependencies on sysbin
- Review system logs and process execution history for evidence of Python installation or pointer.py execution
- Scan systems for the presence of pointer.py and the Python 3.12.3 installer in %TEMP%
- Monitor for suspicious outbound connections to iq-overlay-pointer.vercel.app and related domains
- Assume clipboard and screenshot data may have been exfiltrated; rotate sensitive credentials and review clipboard history
- Block the endpoint https://iq-overlay-pointer.vercel.app/api at the network level
- Review npm audit logs and consider enabling 2FA and package signing verification on npm accounts
Sources
- GitHub Advisory GHSA-jxmp-2j7x-rvwp · GitHub Advisory Database
Cite this entry
"Malicious code in sysbin (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-sysbin-npm-w4kv7g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-models (npm)
The npm package sme-rko-finance-front-operations-feed-models contained malicious code that downloads and executes attacker-controlled native binaries from remote servers upon package load. The malware uses obfuscation techniques including fragmented string arrays, platform-specific endpoints, and DNS TXT record fallbacks to evade detection.
npmCompromised package - resolvedcritical
Malicious code in modern-localization (npm)
The npm package modern-localization contained malicious code that fetches and executes arbitrary JavaScript from a remote jsonbin.io endpoint on server-side require, with no integrity verification. The payload is executed with full Node.js privileges via Function() or child_process.fork().
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-tax (npm)
The npm package sme-rko-finance-front-operations-tax contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure on require. The package was identified and reported by OpenSSF's malicious-packages project.
npmCompromised package - resolvedcritical
Malicious code in localization-fixer (npm)
The npm package localization-fixer contained malicious code that fetches and executes arbitrary JavaScript from attacker-controlled jsonbin.io endpoints on package require, granting full Node.js capabilities to remote payloads.
npmCompromised package