GCVE-110-OSM-2026-10606

The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded JPEG image data to a hardcoded author-controlled endpoint at https://tokyoap.vercel.app/api (API_URL). The destination is not caller-configurable and the package accepts no user-supplied API key, so all installers' clipboard contents and screenshots are routed through the author's proxy. On first run the bin auto-downloads the Python.org installer and pip-installs keyboard, pyautogui, pillow, pyperclip, and requests to support global hotkeys, screen capture, and the relay; a panic-exit hotkey and stealth overlay accompany the capture path. Clipboard buffers and screenshots routinely contain credentials, private messages, and other sensitive material; funnelling them through a hardcoded third-party endpoint materially harms the installer. Judge assessment: This is consistent with a clipboard-and-screen-stealer operated by the package author: `client/noderzero.py` polls `pyperclip.paste()` every 300ms, captures screenshots via `ImageGrab.grab()`, and uses `base64.b64encode()` before sending data to the hardcoded endpoint `https://tokyoap.vercel.app/api`. The bin entrypoint `launcher.js` auto-installs Python and then runs the Python payload with `child_process`, `stdio: 'ignore'`, and a stealth UI, which fits an attacker model of silently harvesting user credentials and private content on the victim machine. The OSV MAL-2026-14271 advisory is corroborated by the actual file contents, not just metadata, and the hardcoded author-controlled C2/exfil path makes the malicious intent clear. This should be treated as a compromised or intentionally abusive package and submitted to OSM. ENTRY launcher.js (bin: launcher.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in client/noderzero.py: "base64.b64encode(" ADDITIONAL FINDINGS - Clipboard Access in client/noderzero.py: "pyperclip.paste()" - Shell Command Execution in launcher.js: "require('child_process')" - Silent Process Execution in launcher.js: "stdio: 'ignore'" PAYLOAD FILES client/noderzero.py (+ launcher.js)