syjoy@1.0.0

Analysis

The package's bin entry (index.js) installs a Python runtime and a stack of automation libraries, then launches a hidden background process (via wscript.exe, detached, window hidden, elevated) that runs pointer.py. pointer.py continuously monitors the system clipboard and, whenever its contents change, POSTs the copied text to hxxps://new-pointer[.]vercel[.]app/api. It also captures full-screen screenshots (base64 JPEG) and extracts text from on-screen regions via UI-automation, POSTing those to the same endpoint. The tool runs as a stealth overlay with global hotkeys and a panic-exit, and is designed to silently harvest clipboard contents and screen captures from the victim's machine and transmit them to the remote endpoint.