Malicious code in sysdo (npm)

The npm package sysdo was identified as containing malicious code that contradicts its declared purpose as a 'System binary configuration tool'. The package's entry point (index.js) silently installs Python 3.12.3 via winget or direct download to %TEMP%, then uses pip to install a surveillance stack including pyperclip, keyboard, mss, pyautogui, pywin32, and uiautomation.

The malicious payload (pointer.py) registers global keyboard hooks and hotkeys to capture keyboard input, extracts clipboard contents via pyperclip, takes screenshots using mss/ImageGrab, and walks UI-automation trees to extract on-screen text. All captured data is exfiltrated via HTTP POST to a hardcoded endpoint at https://iq-sec.vercel.app/api.

The package creates borderless topless windows with empty titles and implements a 'panic_exit' hotkey for covert operation. It can inject text back into the active window via pyautogui, providing operator-assist capability. A bundled start_tool.vbs script uses Shell.Application.ShellExecute to launch the surveillance code with a hidden window (mode 0), ensuring no visible console appears to the user.

The installation process is explicitly designed to avoid user detection, using /quiet flags and comments referencing a 'Ghost Install (No UI, No Admin Popup)'. The exfiltration destination is hardcoded to an author-controlled endpoint rather than any installer-configurable target, confirming malicious intent.