MAL-2026-14254 Malicious code in saaa9 (npm)

The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.js spawns wscript.exe against the bundled start_tool.vbs, which uses Shell.Application.ShellExecute with the 'runas' verb and window state 0 to relaunch cmd.exe silently as administrator and run the bundled pointer.py. If Python is missing, index.js first silently installs Python via winget or, failing that, downloads python-3.12.3-amd64.exe from python.org to %TEMP% and executes it with /quiet InstallAllUsers=0 PrependPath=1, deleting the installer afterward. pointer.py registers global keyboard hotkeys and, on trigger, captures the installer's clipboard, screenshots regions of the active desktop, extracts on-screen text via IAccessible2/UIAutomation, and POSTs the collected data through a persistent requests.Session to the hardcoded endpoint https://iq-overlay-pointer.vercel.app/api. Server responses are auto-typed or pasted back into the active window via pyautogui. The tkinter UI is deliberately concealed (overrideredirect, empty title, transparent color, alpha 0.75, withdraw), and comments labeled 'HACK 1/2' confirm intentional stealth. The package metadata's stated purpose does not correspond to any of the observed behavior.