sysnu

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (eac9873e59ffdf79c56fd4f9366b56e0532f87dc00c4380fae18d714785b0bc8)
On require() / CLI invocation, sysnu performs two install-time-equivalent actions on Windows hosts. First, if `python` is not on PATH, index.js (lines 42-46) runs `curl -s -L -o <tmp>\python-3.12.3-amd64.exe https://www.python.org/ftp/python/3.12.3/python-3.12.3-amd64.exe` and then executes the installer with `/quiet InstallAllUsers=0 PrependPath=1`, deleting the installer afterwards. Code comments explicitly describe this as a 'GHOST INSTALLER' with 'No UI, No Admin Popup' — i.e., the runtime is provisioned and PATH is mutated with no user consent. Second, index.js line 73 unconditionally runs `pip install pyperclip keyboard requests pillow mss pyautogui pywin32 uiautomation comtypes --quiet` — a Windows surveillance stack covering keylogging (keyboard), screen capture (mss/pillow), input automation (pyautogui), clipboard scraping (pyperclip), and UI automation (uiautomation/comtypes/pywin32). Index.js line 81 then spawns `python pointer.py`, but `pointer.py` is NOT present in the tarball, so the package is a stager awaiting an out-of-band payload that will execute with the freshly-installed surveillance primitives available. The package's advertised purpose ('System binary configuration tool') has no relationship to clipboard/keyboard/screen capture. Metadata is placeholder-grade (author 'ABC', no repository/homepage, generic description), consistent with a throwaway dropper account.

Compromised versions (2)

• 1.0.1
• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.