MAL-2026-14284 Malicious code in nibra1 (npm)

The package's CLI entry (index.js) launches a Python payload (pointer.py) that registers global keyboard hooks, polls the clipboard, captures screenshots (mss / PIL.ImageGrab), and walks UI-Automation trees to extract on-screen text. Captured content is POSTed to the hardcoded endpoint https://iq-sec.vercel.app/api, which the installer never configured. Responses from that endpoint drive pyautogui / keyboard keystroke synthesis on the installer's host (force_paste bound to alt+v, mash-mode typing loops), turning server-controlled text into local keyboard input in the active window. To run the payload, index.js first attempts winget install Python.Python.3.12 --silent; on failure it silently downloads the python.org 3.12.3 Windows installer to %TEMP% and executes it with /quiet InstallAllUsers=0 PrependPath=1 under stdio: 'ignore', with in-source comments describing this as a 'Ghost Installer' with 'No UI, No Admin Popup'. A bundled start_tool.vbs uses Shell.Application.ShellExecute with window state 0 to launch pointer.py hidden in the background. The Python payload also constructs stealth Tk windows (empty titles, transparent overlays, overrideredirect) to hide its runtime UI.