{"id":"MAL-2026-13447","summary":"Malicious code in gpt-terminal-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a)\nPackage advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached background daemon (WORMGPT_DAEMON=1, stdio ignored, windowsHide). loader.js additionally spawns itself with --watchdog, polling every 20s to respawn the implant if killed (up to 50 revives), providing self-healing persistence. src/protocol.js hardcodes a C2 endpoint at http://13.60.13.215:7771 and implements an AES-256-GCM + HMAC-signed opcode protocol supporting shell, pyexec, PTY, download/upload, persist, screenshot, keylog, clipboard, webcam, mic, browser credential theft, file loot, lateral movement, privilege escalation, and antiforensics. src/implant/pty.js opens a WebSocket to /pty/\u003cvictimId\u003e on the C2 host and pipes remote base64-decoded bytes into the stdin of a spawned cmd.exe or /bin/bash, with stdout/stderr relayed back — a full reverse PTY shell. protocol.js also polls DNS TXT records on a dead-drop domain every 30 minutes to rotate the C2 URL and update the HMAC secret at runtime, enabling attacker infrastructure agility without any package update. spawnPS() prepends an AMSI-bypass reflection stub (patching amsiInitFailed) via powershell -EncodedCommand to every Windows PowerShell invocation. src/implant/stealers/ and src/implant/recon/ implement the browser credential, clipboard, keylog, and file-loot collectors wired to the OP_*_DATA response envelopes.\n","modified":"2026-08-06T23:50:14.865035607Z","published":"2026-08-06T19:11:33Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-06T19:11:33Z","sha256":"cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-016745","import_time":"2026-08-06T23:25:07.130903516Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gpt-terminal-cli/v/1.0.0"}],"affected":[{"package":{"name":"gpt-terminal-cli","ecosystem":"npm","purl":"pkg:npm/gpt-terminal-cli"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"5a01ce5646aa833015b1c2c0562b653a1a46e0523301d8e0bacce09f6fcb229c77b8de","path":"src/postinstall.js","sha256":"c98489ef4b43aab65323cfb4fd483771a17a607e1199aba12ad9916a84ba4e64"},{"path":"src/protocol.js","sha256":"181d064b60d4607595b474417dbb0c22c964543148b506f58bbfec628e7c0ff5","tlsh":"0512e7683ce5642401a2e8d956bb909bf61260033415e1b0ff4d4790afee93ca23fadd"},{"path":"src/implant/pty.js","sha256":"4ad9d00cc57b708b9094b57376136636ecc8afdc947926feea11b63fe67b2f91","tlsh":"01514147adf4132943fbd0aa9787802af317d0225615deb5bb9d73462f42d3840be5c6"},{"path":"src/implant/loader.js","sha256":"55ee3e2547678cc5d22c9d2c46ed97792b436c5fa823cc72c3173f63d4be95a9","tlsh":"2ca152922eea272c5179d1b29a0f5033eae7d2631641f5a0f58dc0543f5123c46bf9de"}],"package_integrity":[{"hashes":{"sha1":"a048abea41d49773e63dc6a5a83b2582e003c2d9","sha512_sri":"sha512-7YXBJTel1xNRp8FYcHi62dOeEJRBGPlh/6kW2Kw1nsM3oDVEM+/uLcKEwqu1w0Z9v8POqsjte14ErP2FwR4wKA=="},"filename":"gpt-terminal-cli-1.0.0.tgz"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gpt-terminal-cli/MAL-2026-13447.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}