MAL-2026-14215 Malicious code in sysdo (npm)

The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers global keyboard hooks and hotkeys, captures clipboard contents via pyperclip, takes screenshots via mss/ImageGrab, and walks UI-automation trees to extract on-screen text, then POSTs the captured data to the hardcoded endpoint https://iq-sec.vercel.app/api which the installer did not configure. It creates borderless topmost windows with empty titles and a 'panic_exit' hotkey, and can inject text back into the active window via pyautogui, giving covert operator-assist capability on the installer's host. The npm entry point (index.js, invoked via the bin/start script) silently installs Python by first attempting winget and then downloading the python.org 3.12.3 installer to %TEMP% and running it with /quiet flags in comments explicitly framed as a 'Ghost Install (No UI, No Admin Popup)', and pip-installs the surveillance stack (pyperclip, keyboard, mss, pyautogui, pywin32, uiautomation). A bundled start_tool.vbs uses Shell.Application.ShellExecute with a hidden window (mode 0) to launch cmd.exe running pointer.py without a visible console. The declared purpose does not match the observed behavior, and the exfiltration destination is a hardcoded author endpoint rather than any installer-configurable target.