{"answers":{"affected":"1 open source package ship an affected version, including sysdo.","exploited":"There is no known exploitation of MAL-2026-14215 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14215 is a malicious package in sysdo, published on 19 Aug 2026."},"fix_prompt":"MAL-2026-14215 is a malicious package: sysdo (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14215/ (Markdown: https://insights.sbomify.com/MAL-2026-14215/index.md)","id":"MAL-2026-14215","markdown":"https://insights.sbomify.com/MAL-2026-14215/index.md","name":"MAL-2026-14215","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers global keyboard hooks and hotkeys, captures clipboard contents via pyperclip, takes screenshots via mss/ImageGrab, and walks UI-automation trees to extract on-screen text, then POSTs the captured data to the hardcoded endpoint https://iq-sec.vercel.app/api which the installer did not configure. It creates borderless topmost windows with empty titles and a 'panic_exit' hotkey, and can inject text back into the active window via pyautogui, giving covert operator-assist capability on the installer's host. The npm entry point (index.js, invoked via the bin/start script) silently installs Python by first attempting winget and then downloading the python.org 3.12.3 installer to %TEMP% and running it with /quiet flags in comments explicitly framed as a 'Ghost Install (No UI, No Admin Popup)', and pip-installs the surveillance stack (pyperclip, keyboard, mss, pyautogui, pywin32, uiautomation). A bundled start_tool.vbs uses Shell.Application.ShellExecute with a hidden window (mode 0) to launch cmd.exe running pointer.py without a visible console. The declared purpose does not match the observed behavior, and the exfiltration destination is a hardcoded author endpoint rather than any installer-configurable target.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in sysdo (npm)","id":"MAL-2026-14215","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"sysdo","purl":"pkg:npm/sysdo","source":"MAL-2026-14215"}],"products":null,"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14215/"}