The @love-moon/conductor-cli npm package contains malicious code that opens a WebSocket connection to a remote server controlled by an attacker. This connection allows the attacker to send commands that are executed directly on the host system via a spawned shell or AI CLI with disabled safety checks. This results in full remote command execution on the affected system. The affected versions are 0.7.4, 0.7.5, 0.7.6, and 0.8.0. No official patch or remediation guidance is provided in the available data.