The darknode-cli npm package versions 2.46.0, 2.46.1, and 2.46.2 contain malicious code that functions as an offensive-security and penetration testing toolkit. While the package does not automatically execute upon installation or exfiltrate installer-side data, it exposes local HTTP control surfaces and includes modules that catalog offensive tools and sensitive file indicators. The package's capabilities are directed at operator-chosen external targets. According to one source, any system with this package installed or running should be considered fully compromised, and all stored secrets and keys should be rotated immediately.