Malicious code in coderzero (npm)

Source: amazon-inspector 0bd26d5ae306572deded5926f2a32dd34de72377da3363cafc4c4026b9c5a93d When a user runs the coderzero CLI, the bundled Python client client/noderzero.py starts a clipboard monitor that polls pyperclip.paste every 300ms and POSTs any change 5 characters as JSON to a hardcoded UR...

Malicious code in syspo (npm)

Source: amazon-inspector 6f89c590b7c90182cb86bc3e45f71f2357003f4359b6e94818fc996951762f5c The package is published as a 'System binary configuration tool' but its actual behavior is a covert clipboard/screen-capture overlay. On invocation npx/bin entry, index.js spawns pointer.py, which installs ...

Malicious code in pyfernet (PyPI)

Source: kam193 5a2f90c0e3c6e46456cd3e319aaaf4a7b53475a554a997a964fdda898e85fcd0 If imported, the module starts a multi-stage infostealer, exfiltrating browser data as well as crypto wallets, and also attempts to monitor clipboard looking for crypto wallets addresses --- Category: MALICIOUS - The...

Malicious code in polydata-analytics (PyPI)

Source: amazon-inspector 04c2f2ae400ee7411678735073e22d4c662de5653a4add84eaca159ed0ba004a Package self-describes as a Polymarket market-data analytics tool but ships a Windows clipboard monitor src/polymarketdatafetcher/clipper/winclip.py that detects copied BTC/ETH/SOL/TRX/Polygon/BSC wallet...

Clipboard Monitor

Monitor clipboard copy/cut/paste events and poll readable clipboard text from the victim browser from kittysploit import import json import time import uuid class ModuleBrowserAuxiliary: info = "name": "Clipboard Monitor", "description": "Monitor clipboard copy/cut/paste events and poll readable...