MalwarePublished 6 Aug 2026

wormgpt-cli (npm) · Malicious Code

Affects wormgpt-cliSource GCVE Database

Malicious package : remove wormgpt-cli and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13466

What to do

Remove wormgpt-cli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmwormgpt-cli	Affected 1.0.0 – 1.0.8 9 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c) The package's bin entries (`wormgpt-cli`, `wormgpt`, `deepholegpt`, `wgpt`) map to `bin/victim.js`, which silently spawns a detached implant on any invocation (including `--help`/`--version`). The implant connects to a hardcoded C2 at http://13.60.13.215:7771 over an AES-256-GCM/HMAC-signed protocol with pool failover and a DNS TXT dead-drop channel (`protocol.js` `pollDnsDeaddrop`) that rotates the C2 URL and shared secret at runtime. On beacon, `implant.js` `gatherInfo()` collects hostname, user, OS, architecture, PID, cwd, home, LAN IP, admin flag, and a persistent victim_id, and accepts opcodes for shell/PowerShell execution, interactive PTY reverse shell, file up/download, keylogging (`GetAsyncKeyState` PowerShell loop), clipboard capture, screenshots, LAN lateral-movement scanning, privilege-escalation checks, and anti-forensics wipe. `stealers/browser.js` reads Chrome/Edge/Brave/Opera/Vivaldi Login Data SQLite databases, decrypts DPAPI-protected passwords via PowerShell with an AMSI bypass stub (`AMSI_BYPASS_B64` base64 blob run through `powershell -EncodedCommand`), parses Firefox `logins.json`, and regex-scans Discord/Chrome LevelDB for auth tokens (`/[\w-]{24}\.[\w-]{6}\.[\w-]{27}|mfa\.[\w-]{84}/g`), exfiltrating results via C2 opcode OP_BROWSER_DATA. `persist.js` installs persistence across six autostart layers per OS: Windows HKCU/HKLM Run keys, Startup.lnk, WMI __EventFilter/CommandLineEventConsumer permanent subscription, scheduled tasks, and hidden `Windows Helper` directories via `attrib +H +S`; Linux XDG autostart, systemd --user units, `@reboot` crontab, shell RC injection (`.bashrc`/`.zshrc`/`.profile`/`.xinitrc`), and `/etc/rc.local`; macOS LaunchAgent plist with KeepAlive and Login Items via osascript. `loader.js` runs a watchdog sibling process (poll every 20s, `MAX_REVIVES = 50`) plus `uncaughtException` respawn to keep the implant alive.

Impact

This malicious package enables attackers to gain persistent remote access to infected systems, execute arbitrary commands, capture sensitive user input and credentials, steal browser-stored passwords and authentication tokens, perform lateral movement within local networks, and evade forensic analysis through wiping techniques. The implant's persistence across multiple OS autostart mechanisms makes removal difficult. The compromise of authentication tokens and passwords can lead to further account takeovers and data breaches.

Defensive guidance

Users should immediately uninstall the wormgpt-cli package versions 1.0.0 through 1.0.8 and avoid installing or running this package. Investigate and remove any persistent implant components if the package was previously installed. Monitor for suspicious network connections to the indicated C2 IP and domain. Since this is a malicious package, remediation involves removal and system cleanup rather than patching.

Summary

The wormgpt-cli npm package's executable entries map to a script that silently installs a detached implant on execution. This implant connects to a hardcoded C2 server at http://13.60.13.215:7771 using an AES-256-GCM/HMAC-signed protocol with failover and DNS TXT dead-drop channels for dynamic C2 rotation. The implant collects detailed system information and supports commands for shell execution, interactive reverse shells, file transfer, keylogging via PowerShell with AMSI bypass, clipboard capture, screenshots, LAN scanning, privilege escalation checks, and anti-forensics wiping. It steals browser login data from Chrome-based browsers and Firefox, decrypting DPAPI-protected passwords and extracting Discord and Chrome authentication tokens. Persistence is achieved through multiple autostart mechanisms on Windows (registry run keys, startup shortcuts, WMI event subscriptions, scheduled tasks, hidden directories), Linux (XDG autostart, systemd user units, crontab, shell RC injections, rc.local), and macOS (LaunchAgent plist, Login Items). A watchdog process monitors and respawns the implant to maintain persistence. The affected versions explicitly include 1.0.0 through 1.0.8.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 09:01 UTC

Technical details

References

Community reviews