MAL-2026-6375

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gpt-chat-cli/MAL-2026-6375.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6375
Published
2026-06-24T06:02:01Z
Modified
2026-06-24T06:31:21.715302242Z
Summary
Malicious code in gpt-chat-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e8890af695b137878736a36dae473487015eb1954c494fec0b5a6041f0817832)

collect.js bundles a host-reconnaissance and exfiltration payload. It loads child_process, fs, os, http, and https, reads os.hostname() and os.homedir(), enumerates filesystem paths via fs.existsSync(), and POSTs the collected data to the hardcoded endpoint http://aab.sportsontheweb.net (collect.js line 13, POST at line 366). The destination is unrelated to any documented purpose of a 'GPT chat CLI' package and matches the shape of a system-information stealer. Installing this package places attacker-controlled data-collection code into the install tree.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T06:23:52.065262355Z",
            "modified_time": "2026-06-24T06:02:01Z",
            "sha256": "8ccdee952af3407e4e33c563dcd8cab4fe48d6a9ddeea6e008b4dbda0f7ce578",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007424",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-06-24T06:23:52.095582607Z",
            "modified_time": "2026-06-24T06:02:04Z",
            "sha256": "e8890af695b137878736a36dae473487015eb1954c494fec0b5a6041f0817832",
            "versions": [
                "1.0.2"
            ],
            "id": "IN-MAL-2026-007425",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / gpt-chat-cli

Package

Name
gpt-chat-cli
View open source insights on deps.dev
Purl
pkg:npm/gpt-chat-cli

Affected ranges

Affected versions

1.*
1.0.1
1.0.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "44a21e5b14cb351ac747e70ad7670014ad88abb3b113bb41bb8c9bd41f2ad2662d09f9",
            "sha256": "463735e1a5b9150efad9ef66856033363d7ffb55490e84d1bf450c0e1406ef4d",
            "path": "collect.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "gpt-chat-cli-1.0.1.tgz",
            "hashes": {
                "sha1": "56255bcf307bd0c2c6ff8dc71db64bc0432fe7f6",
                "sha512_sri": "sha512-Nx2DouxnShkwdL5Aty0TMnrKpBrdRIc3BTnm26iIDmHT3UTOirdruxV1Xk2z/jdVOCTwDrmHUMxxSMIsdVrhAg=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gpt-chat-cli/MAL-2026-6375.json"