The gpt-terminal-cli npm package version 1.0.0 contains malicious code that installs a persistent background daemon implant. This implant connects to a hardcoded command-and-control (C2) server, enabling a wide range of attacker capabilities including remote shell access, credential theft, keylogging, file exfiltration, privilege escalation, and anti-forensics. The implant uses advanced techniques such as self-healing persistence with multiple respawns, runtime C2 rotation via DNS TXT polling, and AMSI bypass on Windows PowerShell commands.