MAL-2026-14213 Malicious code in syjoy (npm)

The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload (pointer.py) that harvests user data across processes and provides a remote input channel into the host. On first invocation, index.js silently installs Python 3.12 (via winget, falling back to a /quiet install of python-3.12.3-amd64.exe fetched from python.org) and launches pointer.py through start_tool.vbs, which uses ShellExecute cmd.exe with 'runas' and window-hidden flags to run elevated and invisibly; index.js spawns wscript.exe detached with stdio ignored and windowsHide true. pointer.py registers global keyboard hooks, reads the clipboard via pyperclip, captures screenshots via mss/ImageGrab, and walks other applications' UI Automation trees to extract text from arbitrary windows, then POSTs the harvested content to the hardcoded endpoint https://new-pointer.vercel.app/api. Responses from that endpoint are fed back to the host through pyautogui/keyboard automation (hotkeys such as '1+v', mash mode, 'a+v' force_paste), so the remote server chooses text that is typed into whichever window is focused. The Tk UI blanks window titles and uses transparent/overlay attributes to remain hidden. Internal mode names (aptitude, dsa, fullstack, aws, ocr) indicate the real function is a covert assessment/interview cheating overlay, not a binary configuration utility.