Loading npm security reports…

@love-moon/conductor-cli@0.7.4: Malicious npm security report | LPM Firewall

registry / @love-moon/conductor-cli / 0.7.4

@love-moon/conductor-cli@0.7.4

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13428 confirms this npm version as malicious. The `conductor daemon` command (bin/conductor-daemon.js -> src/daemon.js) opens a WebSocket to https://conductor.conductor-ai.top (or a user-configured backend_url) and registers a message handler that, in `handleTerminalInput`, writes `payload.data` received from the server directly into a node-pty process. The PTY is spawned by `handleCreatePtyTask` running either the user's default shell (/bin/bash, /bin/zsh,...

Advisory

MAL-2026-13428

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @love-moon/conductor-cli (npm)

Details

The `conductor daemon` command (bin/conductor-daemon.js -> src/daemon.js) opens a WebSocket to https://conductor.conductor-ai.top (or a user-configured backend_url) and registers a message handler that, in `handleTerminalInput`, writes `payload.data` received from the server directly into a node-pty process. The PTY is spawned by `handleCreatePtyTask` running either the user's default shell (/bin/bash, /bin/zsh, cmd.exe, $SHELL) or a CLI from DEFAULT_CLI_LIST, which launches `codex --dangerously-bypass-approvals-and-sandbox` and `claude --dangerously-skip-permissions` — the same flags are written into the generated config.yaml by bin/conductor-config.js. Any party controlling the WebSocket peer (the Conductor backend, an impersonator on the network, or a compromised backend account) can drive arbitrary commands into the installer's shell or into an AI CLI whose local approval/sandbox gates have been disabled by default. The remote-command channel and the disabled-safety flags together provide full-host command execution driven by conductor-ai.top.

Decision reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory OpenSSF JSON

Source & flagged code

6 flagged · loading source

bin/conductor-update.jsView file

9import fs from "node:fs"; L10: import { spawn } from "node:child_process"; L11: import process from "node:process";

High

Child Process

Package source references child process execution.

bin/conductor-update.jsView on unpkg · L9

199stdio: "inherit", L200: shell: true L201: });

High

Shell

Package source references shell execution.

bin/conductor-update.jsView on unpkg · L199

bin/conductor.jsView file

35const consoleImpl = deps.console || console; L36: const importModule = deps.importModule || ((subcommandPath) => import(subcommandPath)); L37: const env = deps.env || process.env;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/conductor.jsView on unpkg · L35

bin/conductor-fire.jsView file

40const __filename = fileURLToPath(import.meta.url); L41: const __dirname = path.dirname(__filename); L42: const PKG_ROOT = path.join(__dirname, ".."); ... L46: L47: export function isLaunchedByDaemon(env = process.env) { L48: const daemonHostedValue = ... L67: L68: const pkgJson = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf-8")); L69: const CLI_NAME = (process.env.CONDUCTOR_CLI_NAME || path.basename(process.argv[1] || "conductor-fire")).replace( ... L495: this.logger( L496: `[watchdog] Backend websocket healthy again after self-heal via ${signal} (${formatFireWatchdogState({ L497: connectedAt: this.lastConnectedAt,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/conductor-fire.jsView on unpkg · L40

bin/conductor-config.jsView file

50command: "chat-web", L51: execArgs: "--model chatgpt", L52: description: "Chat web (ChatGPT) via @love-moon/chat-web", ... L63: const backendUrl = L64: process.env.CONDUCTOR_BACKEND_URL || L65: process.env.BACKEND_URL || L66: "https://conductor.conductor-ai.top"; L67: const defaultDaemonName = os.hostname() || "my-daemon";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/conductor-config.jsView on unpkg · L50

src/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @love-moon/conductor-cli@0.7.1 matchedIdentity = npm:[redacted]:0.7.1 similarity = 0.971 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/daemon.jsView on unpkg

Source & flagged code

6 flagged

bin/conductor-update.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * conductor update - Check for and install updates to the CLI.

5 */

6

7import { fileURLToPath } from "node:url";

8import path from "node:path";

9import fs from "node:fs";

10import { spawn } from "node:child_process";

11import process from "node:process";

High

Child Process

Package source references child process execution.

bin/conductor-update.jsView on unpkg · L9

12import readline from "node:readline/promises";

13import {

14 PACKAGE_NAME,

15 buildUpgradeCommand,

16 resolveInstallMethod,

17 fetchLatestVersion,

18 isNewerVersion,

19 detectPackageManager,

20} from "../src/version-check.js";

21import {

22 buildPnpmAllowBuildArgs,

23 ensurePnpmOnlyBuiltDependencies,

24 repairAndVerifyGlobalNodePty,

25} from "../src/native-deps.js";

26

27const __filename = fileURLToPath(import.meta.url);

28const __dirname = path.dirname(__filename);

29const PKG_ROOT = path.join(__dirname, "..");

Lines 179-219javascript

179 case "pnpm":

180 cmd = "pnpm";

181 args = ["add", "-g", ...buildPnpmAllowBuildArgs(["node-pty"]), `${PACKAGE_NAME}@latest`];

182 break

bin/conductor.jsView file

Lines 15-55javascript

15 * project - Manage Conductor projects (list/show/create/...)

16 * issue - Manage issues (list/show/create/update/

bin/conductor-fire.jsView file

Lines 20-60javascript

20import yaml from "js-yaml";

21import { createAiSession } from "@love-moon/ai-sdk";

22import { ConductorClient, ProjectContext, loadConfig } from "@love-moon/conductor-sdk";

23import {

24 buildResumeArgsForBackend as

bin/conductor-config.jsView file

Lines 30-70javascript

30 kimi: {

31 command: "kimi",

32 execArgs: "",

33 description: "Moonshot Kimi CLI"

34 },

35 opencode: {

src/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @love-moon/conductor-cli@0.7.1 matchedIdentity = npm:[redacted]:0.7.1 similarity = 0.971 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/daemon.jsView on unpkg