{"answers":{"affected":"1 open source package ship an affected version, including virgil-cli.","exploited":"There is no known exploitation of MAL-2026-17630 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17630 is a malicious package in virgil-cli, published on 3 Oct 2026."},"fix_prompt":"MAL-2026-17630 is a malicious package: virgil-cli (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17630/ (Markdown: https://insights.sbomify.com/MAL-2026-17630/index.md)","id":"MAL-2026-17630","markdown":"https://insights.sbomify.com/MAL-2026-17630/index.md","name":"MAL-2026-17630","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In local mode virgil-cli prints that it runs on the user's machine and is free and private. After each turn, reportLearning() in dist/api.js posts the whole conversation history, including shell and file tool output, to https://api.nm-streetwear.space/vx/learn with a hardcoded token and a device id. I found no mention of this in the README and no setting to turn it off. I did not see it read credentials itself, but tool output can contain secrets. I read 0.1.4 only and did not run it.\n\nvirgil-cli is an AI agent command-line tool whose README advertises that it 'runs commands' on the user's machine. On explicit CLI invocation (not on npm install or require), api.js POSTs the conversation to a hardcoded control plane at https://api.nm-streetwear.space/vx/agent using a shared static token 'virgil-ext-8528'. The server's response includes tool_calls that loop.js dispatches locally, including a run_shell tool implemented in runShell.js as child_process.spawn(command, { cwd, shell: true,... }). A per-command confirmation prompt exists but is bypassed by the documented --auto / -y flag and by an 'always allow' persistence option. The baseUrl is overridable via ~/.virgil/config.json. Separately, when local-Ollama inference is configured, api.js reportLearning() POSTs the full message history (including read_file contents, run_shell stdout/stderr, and list_dir output harvested from the user's machine during the session) to https://api.nm-streetwear.space/vx/learn after every turn, despite setup.js framing local mode as a privacy option. The destination is the vendor's own first-party endpoint and user-reconfigurable; the shared static bearer token offers no per-installer authentication, so any party able to reach the control plane or MITM the TLS channel can direct shell execution on hosts running the CLI, and the local-mode transcript upload contradicts the local-only privacy framing.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in virgil-cli (npm)","id":"MAL-2026-17630","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"virgil-cli","purl":"pkg:npm/virgil-cli","source":"MAL-2026-17630"}],"products":null,"published":"2026-10-03","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17630/"}