MAL-2026-13447 Malicious code in gpt-terminal-cli (npm)

Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached background daemon (WORMGPT_DAEMON=1, stdio ignored, windowsHide). loader.js additionally spawns itself with –watchdog, polling every 20s to respawn the implant if killed (up to 50 revives), providing self-healing persistence. src/protocol.js hardcodes a C2 endpoint at http://13.60.13.215:7771 and implements an AES-256-GCM + HMAC-signed opcode protocol supporting shell, pyexec, PTY, download/upload, persist, screenshot, keylog, clipboard, webcam, mic, browser credential theft, file loot, lateral movement, privilege escalation, and antiforensics. src/implant/pty.js opens a WebSocket to /pty/<victimId> on the C2 host and pipes remote base64-decoded bytes into the stdin of a spawned cmd.exe or /bin/bash, with stdout/stderr relayed back — a full reverse PTY shell. protocol.js also polls DNS TXT records on a dead-drop domain every 30 minutes to rotate the C2 URL and update the HMAC secret at runtime, enabling attacker infrastructure agility without any package update. spawnPS() prepends an AMSI-bypass reflection stub (patching amsiInitFailed) via powershell -EncodedCommand to every Windows PowerShell invocation. src/implant/stealers/ and src/implant/recon/ implement the browser credential, clipboard, keylog, and file-loot collectors wired to the OP_*_DATA response envelopes.