GCVE-110-OSM-2026-11552

This package presents itself as a "System binary configuration tool" — that is its entire manifest description, with keywords system, binary, util and config, an author of "SysDev", and no repository. What it actually installs is a concealed clipboard and screen harvester that elevates itself to Administrator. The chain was read directly. package/index.js probes for a Python interpreter and, if none is found, installs one along with libraries for clipboard access, screen capture, input synthesis and Windows UI Automation — without prompting. It then launches package/start_tool.vbs, whose ten lines are unambiguous: it builds a command to run pointer.py and executes it through ShellExecute with the verb "runas" and a window style of 0, which is to say with User Account Control elevation and no visible window. The author's own comments alongside that line say, in Hinglish, to run the tool silently in the background with admin rights. package/pointer.py then creates windows with blank titles, always-on-top, and with the window manager's decorations suppressed, so nothing appears in the interface. It reads the clipboard on a timer and, whenever the contents change and exceed a few characters, hands the text to a background thread that posts it to https://new-pointer.vercel.app/api. The same endpoint receives base64-encoded screen captures and text scraped from other applications' windows through UI Automation. The response is then typed back into whatever the user is focused on, with randomised delays to mimic human typing. Nothing about clipboard access, screen capture or network transmission appears in the package description, and there is no README. The deception is the decisive element: a tool that genuinely offered this functionality would say so, and would not need to hide its window, blank its title, or elevate itself silently. The three file digests cited were recomputed from the raw registry tarball rather than taken on trust. Note there is no install hook — the chain runs when a user invokes the command — but the package is the only publish from this account and holds the latest tag. Judge assessment: This is a credential-and-data harvesting launcher disguised as a “System binary configuration tool” for a likely unsuspecting user; the attacker model is an npm publisher shipping a trojanized CLI that silently escalates and exfiltrates clipboard/screen data. The entrypoint `index.js` installs Python and packages for `pyperclip`, `keyboard`, `requests`, `mss`, `pyautogui`, `pythoncom`, `uiautomation`, and `comtypes`, then hides execution by spawning `wscript.exe` detached with `stdio: 'ignore'` and `windowsHide: true`. `pointer.py` confirms the payload: it reads `pyperclip.paste()`, uses UI Automation and screen-capture libraries, base64-encodes collected data, and posts it to `https://new-pointer.vercel.app/api`, which the IOC classifier marks as exfil/C2. The fresh publisher account, no repository, and OSV MAL-2026-15674 advisory corroborate the code-level evidence rather than merely explaining it. ENTRY index.js (bin: ./index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in pointer.py: "base64.b64encode(" ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn('wscript.exe', [vbsPath], { detached: true, // Node aur VBS ka connection ..." - Shell Command Execution in index.js: "require('child_process')" - Silent Process Execution in index.js: "stdio: 'ignore'" - Detached Child Process Payload in index.js: "spawn('wscript.exe', [vbsPath], { detached: true" - Clipboard Access in pointer.py: "pyperclip.paste()" - Very New NPM Publisher Account PAYLOAD FILES index.js (+ pointer.py)