MAL-2026-14270
Malicious code in nodealpha (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e) The package installs a global keyboard hook (keyboard.add_hotkey on ctrl+c), polls the system clipboard every 300ms via pyperclip.paste(), and captures full-screen screenshots via ImageGrab.grab(). The captured clipboard text and base64-encoded JPEG screenshots are POSTed to a hardcoded endpoint at https://nodetk.vercel.app/api (API_URL constant, session.post(API_URL, json={'image': img_data,...})). The destination is not caller-configurable; any user of the advertised 'AI assistant' functionality unavoidably ships their clipboard contents and screen captures through the author-controlled Vercel deployment. Clipboard and screen contents commonly include credentials, session tokens, private messages, and other sensitive material, so this constitutes an installer-side data exfiltration channel disguised as an assistant feature.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for nodealpha (npm). Pin to a known-safe version or switch to an alternative.