Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in sysc1 (npm)

The npm package sysc1 contained malicious code that masqueraded as a system configuration tool but deployed a surveillance dropper. On execution, it silently installed Python and dependencies, then spawned a stealth overlay that captured screenshots, clipboard data, and UI text from other applications, exfiltrating the data to a hardcoded endpoint.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installed the sysc1 npm package and executed it (via require or npm start).
Ecosystems
Attack vectors
Affected entities
  • sysc1npm package

The npm package sysc1 was published with malicious code that contradicted its advertised purpose as a 'System binary configuration tool.' When required or executed via npm start, the package's index.js entry point silently bootstrapped Python (via winget or direct download of python-3.12.3-amd64.exe), then pip-installed surveillance libraries (keyboard, pyautogui, mss, uiautomation, pywin32).

The package then spawned a bundled Python script (pointer.py) that created a topmost transparent overlay window with global hotkeys for stealth control. This overlay captured screenshots via ImageGrab/mss, read clipboard contents, and walked the UI trees of running applications—including a documented 'CHROME BYPASS' to scrape text from Chrome despite its security model.

All captured data (screenshots, clipboard, harvested UI text) was exfiltrated via HTTP POST requests to a hardcoded author-controlled endpoint at https://new-pointer.vercel.app/api. The combination of silent Python installation, stealth overlay, cross-application UI scraping, and hardcoded exfiltration endpoint constitutes a coordinated surveillance dropper.

The incident was identified and credited to the OpenSSF's malicious-packages project.

Indicators of compromise

Packages
  • sysc1
Domains
  • new-pointer.vercel.app
Hashes
  • 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f

Remediation

  • Immediately uninstall the sysc1 package from all systems: npm uninstall sysc1
  • Audit npm install logs and package-lock.json to identify all systems where sysc1 was installed
  • On affected Windows systems, check for unexpected Python installations (python-3.12.3-amd64.exe) and remove them
  • Review running processes for pointer.py or related Python surveillance scripts and terminate them
  • Check for unexpected pip packages (keyboard, pyautogui, mss, uiautomation, pywin32) and uninstall them
  • Monitor network traffic for POST requests to https://new-pointer.vercel.app/api and block the domain
  • Review clipboard history and screenshots for sensitive data exposure
  • Consider the system compromised; perform a full security audit and credential rotation for any sensitive accounts used on affected machines

Sources

  1. GitHub Advisory GHSA-w7f3-qj9q-xjcv · GitHub Advisory Database

Cite this entry

"Malicious code in sysc1 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-sysc1-npm-11htzh

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malicious code in 3-buildsight-web (npm)

    The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.

    npmCompromised package
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in create-coin (npm)

    create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in @syncraft-labs/vue (npm)

    The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.

    npmCompromised package