nodeberlin @1.0.7
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 11:52 AM UTC
OSV ID
MAL-2026-14271
Ecosystem
npm
Summary
The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded JPEG image data to a hardcoded author-controlled endpoint at https://tokyoap.vercel.app/api (API_URL). The destination is not caller-configurable and the package accepts no user-supplied API key, so all installers' clipboard contents and screenshots are routed through the author's proxy. On first run the bin auto-downloads the Python.org installer and pip-installs keyboard, pyautogui, pillow, pyperclip, and requests to support global hotkeys, screen capture, and the relay; a panic-exit hotkey and stealth overlay accompany the capture path. Clipboard buffers and screenshots routinely contain credentials, private messages, and other sensitive material; funnelling them through a hardcoded third-party endpoint materially harms the installer.
Source: amazon-inspector (0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.