MalwarePublished 6 Aug 2026

@love-moon/conductor-cli (npm) · Malicious Code

Affects @love-moon/conductor-cliSource GCVE Database

Malicious package : remove @love-moon/conductor-cli and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13428

What to do

Remove @love-moon/conductor-cli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@love-moon/conductor-cli	Affected 0.7.4 – 0.8.0 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @love-moon/conductor-cli npm package contains malicious code that opens a WebSocket connection to a remote server controlled by an attacker. This connection allows the attacker to send commands that are executed directly on the host system via a spawned shell or AI CLI with disabled safety checks. This results in full remote command execution on the affected system. The affected versions are 0.7.4, 0.7.5, 0.7.6, and 0.8.0. No official patch or remediation guidance is provided in the available data.

Impact

An attacker controlling the WebSocket server or able to impersonate it can execute arbitrary commands on the host machine where the package is installed. This leads to full host compromise, including the ability to run any code with the privileges of the user running the conductor-cli. The disabled safety flags in the AI CLI components further remove any local approval or sandbox restrictions, increasing the risk and impact of exploitation.

Defensive guidance

Users should immediately discontinue use of the affected versions (0.7.4, 0.7.5, 0.7.6, 0.8.0) of @love-moon/conductor-cli and avoid connecting to untrusted WebSocket endpoints. Monitor vendor advisories for any forthcoming fixes or official guidance. Until a fix is available, do not run this package in any environment where security is a concern.

Summary

The conductor daemon component of the @love-moon/conductor-cli package establishes a WebSocket connection to https://conductor.conductor-ai.top or a user-configured backend URL. It registers a message handler that writes data received from the server directly into a node-pty process running the user's default shell or an AI CLI with disabled approval and sandboxing flags. This design allows any party controlling the WebSocket endpoint or intercepting the connection to execute arbitrary commands on the host system, effectively granting full remote code execution capabilities. The malicious behavior is present in versions 0.7.4, 0.7.5, 0.7.6, and 0.8.0 of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:29 UTC

Technical details

References

Community reviews