MAL-2026-14270

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nodealpha/MAL-2026-14270.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14270
Published
2026-08-19T07:18:57Z
Modified
2026-08-19T07:31:56.221335657Z
Summary
Malicious code in nodealpha (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e)

The package installs a global keyboard hook (keyboard.addhotkey on ctrl+c), polls the system clipboard every 300ms via pyperclip.paste(), and captures full-screen screenshots via ImageGrab.grab(). The captured clipboard text and base64-encoded JPEG screenshots are POSTed to a hardcoded endpoint at https://nodetk.vercel.app/api (APIURL constant, session.post(APIURL, json={'image': imgdata,...})). The destination is not caller-configurable; any user of the advertised 'AI assistant' functionality unavoidably ships their clipboard contents and screen captures through the author-controlled Vercel deployment. Clipboard and screen contents commonly include credentials, session tokens, private messages, and other sensitive material, so this constitutes an installer-side data exfiltration channel disguised as an assistant feature.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.7"
            ],
            "import_time": "2026-08-19T07:21:22.173463588Z",
            "modified_time": "2026-08-19T07:18:57Z",
            "id": "IN-MAL-2026-018388",
            "sha256": "423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / nodealpha

Package

Name
nodealpha
View open source insights on deps.dev
Purl
pkg:npm/nodealpha

Affected ranges

Affected versions

1.*
1.0.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "nodealpha-1.0.7.tgz",
            "hashes": {
                "sha1": "e231cc00da41ecd65f140577d0d60b4ace020011",
                "sha512_sri": "sha512-WfxQfgHB2P1FxjbZFcn8cRDhIDALd3MosglurcAcjoVUbZSAkTtMxomuIDfkLGtmlPw6IPut+qx5C+/svw8f+A=="
            }
        }
    ],
    "evidence_files": [
        {
            "path": "client/noderzero.py",
            "tlsh": "3fc2d976a0085859f663dc1f8996b5132e1e3e437a4ca528bcfcb9950fcc32685e1ef1",
            "sha256": "d783541b99ec56fc97f5110d2739e012097232607da4d20bea50c1c3051d0a80"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nodealpha/MAL-2026-14270.json"