Public package RATs using JSON-bin relays: what teams should watch

TL;DR: A PyPI package called gcli-control shipped a Windows RAT with keylogging, webcam and microphone capture, browser credential access, persistence, and a command channel that used npoint.io as a JSON-bin dead-drop, showing how legitimate SaaS can mask malicious traffic, according to Xygeni. The pattern matters because package reputation alone no longer separates benign developer tools from covert control planes.

NHIMG editorial — based on content published by Xygeni: analysis of the gcli-control package and its JSON-bin command relay

Questions worth separating out

Q: What breaks when a package can run as a RAT without install-time hooks?

A: Install-time checks miss the risk because the payload does not execute until runtime.

Q: Why do legitimate SaaS relays make malware harder to stop?

A: Because blocking the service can be operationally expensive and the attacker can switch relays with minimal effort.

Q: How do security teams identify secret theft on developer endpoints?

A: Look for a process that combines credential-store access, clipboard reads, screen or camera capture, and outbound polling to nonstandard services in the same session.

Practitioner guidance

• Enforce runtime-based package review Require human review for any package that can capture input devices, access browser credential stores, or control the desktop, even if its metadata looks benign.
• Detect host-surveillance plus SaaS egress Alert when a single process both touches webcam, microphone, clipboard, screen capture, or browser secrets and sends requests to a public paste, JSON-bin, or webhook service.
• Treat developer endpoints as identity-sensitive assets Apply stricter controls to developer workstations and CI runners because they often hold tokens, session material, and API keys that extend beyond human account risk.

What's in the full analysis

Xygeni's full analysis covers the operational detail this post intentionally leaves for the source:

• The package-level indicators that separated this sample from ordinary developer tooling on PyPI
• The module-by-module behaviour map for surveillance, persistence, elevation, and command handling
• The exact JSON-bin relay pattern used to move encrypted commands and results through npoint.io
• The indicator logic Xygeni used to distinguish a package with suspicious runtime capability from a benign utility

👉 Read Xygeni's analysis of the gcli-control package and JSON-bin C2 pattern →

Public package RATs using JSON-bin relays: what teams should watch?

Explore further

View Full Forum →  |  NHI Foundation Course →