registry / sysb1 / 1.0.3

sysb1@1.0.3

System binary configuration tool

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Running the sysb1 CLI launches a concealed Windows overlay that automatically sends clipboard contents to a remote endpoint. A user hotkey can also capture and upload the full display; returned content can be injected as keyboard input.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

User invokes sysb1 or npm start; clipboard monitoring begins immediately, while screenshot upload requires its registered hotkey.

Impact

Sensitive clipboard data and screenshots can be disclosed to a third party; remote responses can be typed into the active application.

Mechanism

Stealth clipboard/screen exfiltration with remote-response keyboard automation.

Attack narrative

When a user runs the advertised system utility, index.js launches pointer.py. The program hides its overlay, polls the clipboard every 300 ms, and sends changed text to iq-overlay-pointer.vercel.app without a per-item consent action. Its screen hotkey uploads a base64 image of the primary display. It also accepts remote answers into the clipboard and can automate or suppress keyboard input. A separate included VBS launcher requests elevation and hides execution.

Rationale

The package is a concealed remote data-collection and input-automation tool unrelated to its stated system-binary configuration purpose. Although no install hook runs it automatically, explicit CLI execution exposes clipboard and screen data without adequate consent.

Evidence

package.jsonindex.jspointer.pystart_tool.vbs%TEMP%/python-3.12.3-amd64.exe

Network endpoints2

/api

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

pointer.py monitors clipboard every 300ms and posts changed text to a remote API.
pointer.py captures the full screen, base64-encodes it, and uploads it to the same API.
pointer.py implements hidden transparent UI, global hotkeys, and keyboard-input suppression/automation.
start_tool.vbs requests elevation and silently launches pointer.py.
index.js silently installs Python and privileged automation dependencies when the CLI is run.

Evidence against

package.json contains no npm lifecycle hook; execution requires invoking the bin/start command.
The Python installer URL is python.org and is only used when Python is absent.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.08 KB of source, external domains: www.python.org

Source & flagged code

2 flagged

pointer.pyView file

•path = pointer.py kind = build_helper sizeBytes = 38022 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pointer.pyView on unpkg

index.jsView file

•matchType = malicious_source_fingerprint_signature signature = dcd6e9f81522be69 signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = sysb1@1.0.0 matchedPath = index.js matchedIdentity = npm:c3lzYjE:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = Malicious code in sysb1 (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

2 flagged · loading source

pointer.pyView file

•path = pointer.py kind = build_helper sizeBytes = 38022 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pointer.pyView on unpkg

index.jsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Findings

1 High3 Medium4 Low

HighKnown Malware Source Fingerprint Signatureindex.js

MediumEnvironment Vars

MediumShips Build Helperpointer.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings