The wormgpt-cli npm package's executable entries map to a script that silently installs a detached implant on execution. This implant connects to a hardcoded C2 server at http://13.60.13.215:7771 using an AES-256-GCM/HMAC-signed protocol with failover and DNS TXT dead-drop channels for dynamic C2 rotation. The implant collects detailed system information and supports commands for shell execution, interactive reverse shells, file transfer, keylogging via PowerShell with AMSI bypass, clipboard capture, screenshots, LAN scanning, privilege escalation checks, and anti-forensics wiping. It steals browser login data from Chrome-based browsers and Firefox, decrypting DPAPI-protected passwords and extracting Discord and Chrome authentication tokens. Persistence is achieved through multiple autostart mechanisms on Windows (registry run keys, startup shortcuts, WMI event subscriptions, scheduled tasks, hidden directories), Linux (XDG autostart, systemd user units, crontab, shell RC injections, rc.local), and macOS (LaunchAgent plist, Login Items). A watchdog process monitors and respawns the implant to maintain persistence. The affected versions explicitly include 1.0.0 through 1.0.8.

This malicious package enables attackers to gain persistent remote access to infected systems, execute arbitrary commands, capture sensitive user input and credentials, steal browser-stored passwords and authentication tokens, perform lateral movement within local networks, and evade forensic analysis through wiping techniques. The implant's persistence across multiple OS autostart mechanisms makes removal difficult. The compromise of authentication tokens and passwords can lead to further account takeovers and data breaches.

No official patch or remediation guidance is provided in the source data. Users should immediately uninstall the wormgpt-cli package versions 1.0.0 through 1.0.8 and avoid installing or running this package. Investigate and remove any persistent implant components if the package was previously installed. Monitor for suspicious network connections to the indicated C2 IP and domain. Since this is a malicious package, remediation involves removal and system cleanup rather than patching. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.