MAL-2026-6406 Malicious code in syspo (npm)

Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveillance dropper. On invocation, index.js silently installs a Python 3.12 runtime (via winget or by curling https://www.python.org/ftp/python/3.12.3/python-3.12.3-amd64.exe to %TEMP% and running it with /quiet InstallAllUsers=0 PrependPath=1) and pip-installs a surveillance toolchain (pyperclip, keyboard, requests, pillow, mss, pyautogui, pywin32, uiautomation, comtypes). A bundled start_tool.vbs is then launched detached with windowsHide, invoking Shell.Application.ShellExecute with verb 'runas' and windowStyle 0 to run cmd /c cd /d <dir> && python pointer.py elevated and with no visible window. pointer.py registers global keyboard hotkeys, captures screen regions with mss and PIL.ImageGrab, walks the foreground window's UIAutomation tree to extract text from EditControls, TextPattern DocumentRange, and LegacyIAccessiblePattern (routinely capturing browser fields, password inputs, and arbitrary application text), base64-encodes screenshots, and POSTs the harvested data via requests.Session to the hardcoded endpoint https://new-pointer.vercel.app/api which the installer did not configure. Source comments explicitly label the stages 'GHOST INSTALLER', 'VBSCRIPT STEALTH MODE', and 'HACK 1/2'. Transparent topmost tk windows with blank titles, overrideredirect, and 1x1 dot labels are used to hide the running surveillance UI from the user.