MAL-2026-5617 Malicious code in sysnu (npm)

On require() / CLI invocation, sysnu performs two install-time-equivalent actions on Windows hosts. First, if python is not on PATH, index.js (lines 42-46) runs curl -s -L -o <tmp>\python-3.12.3-amd64.exe https://www.python.org/ftp/python/3.12.3/python-3.12.3-amd64.exe and then executes the installer with /quiet InstallAllUsers=0 PrependPath=1, deleting the installer afterwards. Code comments explicitly describe this as a 'GHOST INSTALLER' with 'No UI, No Admin Popup' — i.e., the runtime is provisioned and PATH is mutated with no user consent. Second, index.js line 73 unconditionally runs pip install pyperclip keyboard requests pillow mss pyautogui pywin32 uiautomation comtypes --quiet — a Windows surveillance stack covering keylogging (keyboard), screen capture (mss/pillow), input automation (pyautogui), clipboard scraping (pyperclip), and UI automation (uiautomation/comtypes/pywin32). Index.js line 81 then spawns python pointer.py, but pointer.py is NOT present in the tarball, so the package is a stager awaiting an out-of-band payload that will execute with the freshly-installed surveillance primitives available. The package's advertised purpose ('System binary configuration tool') has no relationship to clipboard/keyboard/screen capture. Metadata is placeholder-grade (author 'ABC', no repository/homepage, generic description), consistent with a throwaway dropper account.