OpenSSF/OSV advisory MAL-2026-14254 confirms this npm version as malicious. The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.js spawns wscript.exe against the bundled start_tool.vbs, which uses Shell.Application.ShellExecute with the 'runas' verb and window state 0 to relaunch cmd.exe silently as administrator and run the bundled pointer.py. If Python is missing, index.js first silently...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in saaa9 (npm)
Details
The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.js spawns wscript.exe against the bundled start_tool.vbs, which uses Shell.Application.ShellExecute with the 'runas' verb and window state 0 to relaunch cmd.exe silently as administrator and run the bundled pointer.py. If Python is missing, index.js first silently installs Python via winget or, failing that, downloads python-3.12.3-amd64.exe from python.org to %TEMP% and executes it with /quiet InstallAllUsers=0 PrependPath=1, deleting the installer afterward. pointer.py registers global keyboard hotkeys and, on trigger, captures the installer's clipboard, screenshots regions of the active desktop, extracts on-screen text via IAccessible2/UIAutomation, and POSTs the collected data through a persistent requests.Session to the hardcoded endpoint https://iq-overlay-pointer.vercel.app/api. Server responses are auto-typed or pasted back into the active window via pyautogui. The tkinter UI is deliberately concealed (overrideredirect, empty title, transparent color, alpha 0.75, withdraw), and comments labeled 'HACK 1/2' confirm intentional stealth. The package metadata's stated purpose does not correspond to any of the observed behavior.
Decision reason
No blocking static signals were detected.