nodetokyo

GHSA-pwpm-7qvr-qmc7

Malicious code in nodetokyo (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.8`

## Source: amazon-inspector (9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203)
The package's declared main (launcher.js) executes launch() at module top level, so require('nodetokyo') automatically installs Python 3.12 (via winget or by downloading the python.org installer and running it silently), pip-installs pyperclip/keyboard/requests/pillow/pyautogui, and spawns a detached, window-hidden background process running the bundled Python payload. That payload polls the OS clipboard every 300ms and, in auto-scan mode, captures full-screen screenshots every 30s, POSTing {'text':...} and {'image': <base64>} to the hardcoded endpoint https://nodetokyo.vercel.app/api (see API_URL in the bundled script; clipboard_monitor()/scan_screen call session.post(API_URL,...)). The destination is not caller-configurable. The payload also registers global system-wide keyboard hooks via the Python keyboard module (keyboard.on_press with suppress=True; keyboard.add_hotkey('ctrl+c',...)) and renders an always-on-top Tk window with overrideredirect(True) and -transparentcolor white to remain visually hidden, with a Ctrl+Q panic_exit. Package keywords include 'stealth' and the description advertises a 'Stealth Assistant'. Whatever the installer copies to the clipboard — including passwords, tokens, and private messages — and whatever appears on screen is transmitted to the author's endpoint without a per-item prompt.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/39358a8292b2512d6ac0a00210489c0550399f2d/osv/malicious/npm/nodetokyo/MAL-2026-16388.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/39358a8292b2512d6ac0a00210489c0550399f2d/osv/malicious/npm/nodetokyo/MAL-2026-16388.json
- https://www.npmjs.com/package/nodetokyo/v/1.0.8
- https://github.com/advisories/GHSA-pwpm-7qvr-qmc7

Compromised versions (1)

= 1.0.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.