MAL-2026-13466

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wormgpt-cli/MAL-2026-13466.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13466

Published

2026-08-06T19:10:40Z

Modified

2026-08-07T01:19:49.581849153Z

Summary

Malicious code in wormgpt-cli (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c)

The package's bin entries (wormgpt-cli, wormgpt, deepholegpt, wgpt) map to bin/victim.js, which silently spawns a detached implant on any invocation (including --help/--version). The implant connects to a hardcoded C2 at http://13.60.13.215:7771 over an AES-256-GCM/HMAC-signed protocol with pool failover and a DNS TXT dead-drop channel (protocol.js pollDnsDeaddrop) that rotates the C2 URL and shared secret at runtime. On beacon, implant.js gatherInfo() collects hostname, user, OS, architecture, PID, cwd, home, LAN IP, admin flag, and a persistent victimid, and accepts opcodes for shell/PowerShell execution, interactive PTY reverse shell, file up/download, keylogging (GetAsyncKeyState PowerShell loop), clipboard capture, screenshots, LAN lateral-movement scanning, privilege-escalation checks, and anti-forensics wipe. stealers/browser.js reads Chrome/Edge/Brave/Opera/Vivaldi Login Data SQLite databases, decrypts DPAPI-protected passwords via PowerShell with an AMSI bypass stub (AMSI_BYPASS_B64 base64 blob run through powershell -EncodedCommand), parses Firefox logins.json, and regex-scans Discord/Chrome LevelDB for auth tokens (/[\w-]{24}\.[\w-]{6}\.[\w-]{27}|mfa\.[\w-]{84}/g), exfiltrating results via C2 opcode OPBROWSER_DATA. persist.js installs persistence across six autostart layers per OS: Windows HKCU/HKLM Run keys, Startup.lnk, WMI __EventFilter/CommandLineEventConsumer permanent subscription, scheduled tasks, and hidden Windows Helper directories via attrib +H +S; Linux XDG autostart, systemd --user units, @reboot crontab, shell RC injection (.bashrc/.zshrc/.profile/.xinitrc), and /etc/rc.local; macOS LaunchAgent plist with KeepAlive and Login Items via osascript. loader.js runs a watchdog sibling process (poll every 20s, MAX_REVIVES = 50) plus uncaughtException respawn to keep the implant alive.

Database specific

{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "6f76eeb5f3df3c8ebc673a73d88aeb6dd0eb89b2b350a36023e2fe2a42eb8ed1",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-016743",
            "modified_time": "2026-08-06T19:10:40Z",
            "import_time": "2026-08-06T23:25:07.052435408Z"
        },
        {
            "import_time": "2026-08-07T00:59:23.177679581Z",
            "sha256": "c19fcfc558eeb517443b7175909cc46461cde81d1b21fb85453599ad152a0ea5",
            "versions": [
                "1.0.3"
            ],
            "id": "IN-MAL-2026-016865",
            "modified_time": "2026-08-06T23:59:48Z",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-07T00:59:22.795470011Z",
            "sha256": "eebdb11a91bed2a4772d539dc747d9e3ebbf691dda914003b5f8489f0adeeb8c",
            "versions": [
                "1.0.8"
            ],
            "id": "IN-MAL-2026-016861",
            "modified_time": "2026-08-06T23:59:17Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "sha256": "f5b2b75cd854946d520e769fef83618dd912cde948ea954a51eb716661302702",
            "versions": [
                "1.0.4"
            ],
            "id": "IN-MAL-2026-016866",
            "modified_time": "2026-08-06T23:59:56Z",
            "import_time": "2026-08-07T00:59:23.278554169Z"
        },
        {
            "source": "amazon-inspector",
            "sha256": "1e2405ae20c3c88dd3adeaa11ed725879aad3625226f4a252748daca8f0874a5",
            "versions": [
                "1.0.7"
            ],
            "id": "IN-MAL-2026-016863",
            "modified_time": "2026-08-06T23:59:33Z",
            "import_time": "2026-08-07T00:59:22.99668467Z"
        },
        {
            "import_time": "2026-08-07T00:59:23.381754662Z",
            "sha256": "534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c",
            "versions": [
                "1.0.2"
            ],
            "id": "IN-MAL-2026-016867",
            "modified_time": "2026-08-07T00:00:04Z",
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "sha256": "56bfdc165a63f6eecd4e33262562a3b65da59da549298568c42e6b1e530f8860",
            "versions": [
                "1.0.5"
            ],
            "id": "IN-MAL-2026-016864",
            "modified_time": "2026-08-06T23:59:41Z",
            "import_time": "2026-08-07T00:59:23.083960016Z"
        },
        {
            "source": "amazon-inspector",
            "sha256": "8b03000b5f21aa6e61de1a5bf5149d0059372d0663ffda561d2ea8df59062630",
            "id": "IN-MAL-2026-016868",
            "versions": [
                "1.0.1"
            ],
            "modified_time": "2026-08-07T00:00:13Z",
            "import_time": "2026-08-07T00:59:23.467747845Z"
        },
        {
            "source": "amazon-inspector",
            "sha256": "a0ae945d716ee5032c1527fc139d67cd5dee3b155030441574fac459c27a14a6",
            "versions": [
                "1.0.6"
            ],
            "id": "IN-MAL-2026-016862",
            "modified_time": "2026-08-06T23:59:25Z",
            "import_time": "2026-08-07T00:59:22.902902659Z"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / wormgpt-cli

Package

Name: wormgpt-cli; View open source insights on deps.dev
Purl: pkg:npm/wormgpt-cli

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

Database specific

cwes

[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

indicators

{
    "evidence_files": [
        {
            "sha256": "f43c7c2eb90ce5ce4e1985e940b8da0dede7eda683f1d4f83237e37e0bfe4b65",
            "path": "src/implant/implant.js",
            "tlsh": "ec82958a7efb64344162f16216270019faaad0271709cdf47eac5794ff6433481feae9"
        },
        {
            "sha256": "eb13c4e8c61c4a10dd91b589ef65714751556a5e02224e279b04e467f28869e1",
            "tlsh": "146177c28ffbf4b08aa2dcb54803085ae97510724556da95765e449cef0fa3091fcf89",
            "path": "src/implant/stealers/clipboard.js"
        },
        {
            "sha256": "181d064b60d4607595b474417dbb0c22c964543148b506f58bbfec628e7c0ff5",
            "path": "src/protocol.js",
            "tlsh": "0512e7683ce5642401a2e8d956bb909bf61260033415e1b0ff4d4790afee93ca23fadd"
        }
    ],
    "package_integrity": [
        {
            "filename": "wormgpt-cli-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-c4t07L2va7I5gSiRHAbCzZEVRW9a3YRYDKdqHmKWHXTckdHXle/qkDUNKDeU32Jyf1G+pnu8CYtt2tRQshvvaQ==",
                "sha1": "6bc93888985a9068663ec6537ca17097324ab5a2"
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wormgpt-cli/MAL-2026-13466.json"