registry / bqq1 / 1.0.0

bqq1@1.0.0

System binary configuration tool

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Running the bqq1 CLI starts a concealed global-hotkey program. It continuously reads changed clipboard content and exfiltrates it; a hotkey captures and uploads screenshots.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs the bqq1 CLI

Impact

Sensitive clipboard text and screen contents can be disclosed to a remote server.

Mechanism

clipboard polling and screenshot capture sent by HTTP POST

Attack narrative

The package has no install hook, but its declared CLI starts pointer.py. That program creates a hidden transparent UI, repeatedly checks clipboard contents, and POSTs changed text to a remote Vercel endpoint without a per-item user action. It can also capture the screen, encode it, and upload it to the same endpoint. This is a concrete runtime data-exfiltration capability with stealth-oriented presentation.

Rationale

Source establishes automatic clipboard exfiltration to a hard-coded remote endpoint after the CLI is run, with optional screenshot upload and stealth controls. The absence of lifecycle execution does not negate the malicious runtime behavior.

Evidence

package.jsonindex.jspointer.py

Network endpoints1

iq-sec.vercel.app/api

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14164

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in bqq1 (npm)

Details

The npm package bqq1 advertises itself as a 'System binary configuration tool' but ships a covert surveillance and remote-control payload. On require/start, index.js unconditionally executes startApp(), which silently installs Python 3.12 (via winget, or by downloading the python.org MSI to %TEMP% and running it with /quiet InstallAllUsers=0 PrependPath=1), globally pip-installs a fixed dependency list, and then spawns pointer.py without any prompt, consent, or README documentation. pointer.py installs global keyboard hooks, reads the clipboard via pyperclip, captures screen regions using mss and PIL ImageGrab, and walks the Windows UIAutomation tree to scrape text from other applications' UI. The captured data is POSTed to the hardcoded endpoint https://iq-sec.vercel.app/api. The response body from that endpoint is fed into pyautogui, which types the remote-controlled text into whatever window is focused on the host, driven by global hotkeys (trigger_api, force_paste, retry_api). The UI runs in borderless Tk windows with blank titles, overrideredirect, and transparent overlays, plus 'stealth_hide' and 'panic_exit' hotkeys — explicit stealth engineering that contradicts the package's declared purpose.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The CLI launches bundled pointer.py after installing dependencies.
pointer.py polls the clipboard every 300ms and sends changed text to a remote endpoint.
The program captures screenshots and posts their base64 content to that endpoint.
The UI is intentionally hidden/transparent and registers global hotkeys.

Evidence against

package.json contains no npm lifecycle hook; execution requires running the bqq1 CLI.
Screenshot capture is bound to a registered hotkey.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.09 KB of source, external domains: www.python.org

Source & flagged code

3 flagged

pointer.pyView file

•path = pointer.py kind = build_helper sizeBytes = 31813 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pointer.pyView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = gfff5@1.0.0 matchedPath = index.js matchedIdentity = npm:Z2ZmZjU:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d9975c373b21cec0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = gfff5@1.0.0 matchedPath = index.js matchedIdentity = npm:Z2ZmZjU:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

Source & flagged code

3 flagged · loading source

pointer.pyView file

•path = pointer.py kind = build_helper sizeBytes = 31813 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pointer.pyView on unpkg

index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Findings

2 High3 Medium4 Low

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumEnvironment Vars

MediumShips Build Helperpointer.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings