{"answers":{"affected":"1 open source package ship an affected version, including gpt-terminal-cli.","exploited":"There is no known exploitation of MAL-2026-13447 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13447 is a malicious package in gpt-terminal-cli, published on 6 Aug 2026."},"fix_prompt":"MAL-2026-13447 is a malicious package: gpt-terminal-cli (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13447/ (Markdown: https://insights.sbomify.com/MAL-2026-13447/index.md)","id":"MAL-2026-13447","markdown":"https://insights.sbomify.com/MAL-2026-13447/index.md","name":"MAL-2026-13447","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached background daemon (WORMGPT_DAEMON=1, stdio ignored, windowsHide). loader.js additionally spawns itself with --watchdog, polling every 20s to respawn the implant if killed (up to 50 revives), providing self-healing persistence. src/protocol.js hardcodes a C2 endpoint at http://13.60.13.215:7771 and implements an AES-256-GCM + HMAC-signed opcode protocol supporting shell, pyexec, PTY, download/upload, persist, screenshot, keylog, clipboard, webcam, mic, browser credential theft, file loot, lateral movement, privilege escalation, and antiforensics. src/implant/pty.js opens a WebSocket to /pty/\u003cvictimId\u003e on the C2 host and pipes remote base64-decoded bytes into the stdin of a spawned cmd.exe or /bin/bash, with stdout/stderr relayed back — a full reverse PTY shell. protocol.js also polls DNS TXT records on a dead-drop domain every 30 minutes to rotate the C2 URL and update the HMAC secret at runtime, enabling attacker infrastructure agility without any package update. spawnPS() prepends an AMSI-bypass reflection stub (patching amsiInitFailed) via powershell -EncodedCommand to every Windows PowerShell invocation. src/implant/stealers/ and src/implant/recon/ implement the browser credential, clipboard, keylog, and file-loot collectors wired to the OP_*_DATA response envelopes.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in gpt-terminal-cli (npm)","id":"MAL-2026-13447","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"gpt-terminal-cli","purl":"pkg:npm/gpt-terminal-cli","source":"MAL-2026-13447"}],"products":null,"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13447/"}