Loading npm security reports…

@love-moon/conductor-cli@0.7.5: Malicious npm security report | LPM Firewall

registry / @love-moon/conductor-cli / 0.7.5

@love-moon/conductor-cli@0.7.5

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13428 confirms this npm version as malicious. The `conductor daemon` command (bin/conductor-daemon.js -> src/daemon.js) opens a WebSocket to https://conductor.conductor-ai.top (or a user-configured backend_url) and registers a message handler that, in `handleTerminalInput`, writes `payload.data` received from the server directly into a node-pty process. The PTY is spawned by `handleCreatePtyTask` running either the user's default shell (/bin/bash, /bin/zsh,...

Advisory

MAL-2026-13428

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @love-moon/conductor-cli (npm)

Details

The `conductor daemon` command (bin/conductor-daemon.js -> src/daemon.js) opens a WebSocket to https://conductor.conductor-ai.top (or a user-configured backend_url) and registers a message handler that, in `handleTerminalInput`, writes `payload.data` received from the server directly into a node-pty process. The PTY is spawned by `handleCreatePtyTask` running either the user's default shell (/bin/bash, /bin/zsh, cmd.exe, $SHELL) or a CLI from DEFAULT_CLI_LIST, which launches `codex --dangerously-bypass-approvals-and-sandbox` and `claude --dangerously-skip-permissions` — the same flags are written into the generated config.yaml by bin/conductor-config.js. Any party controlling the WebSocket peer (the Conductor backend, an impersonator on the network, or a compromised backend account) can drive arbitrary commands into the installer's shell or into an AI CLI whose local approval/sandbox gates have been disabled by default. The remote-command channel and the disabled-safety flags together provide full-host command execution driven by conductor-ai.top.

Decision reason

No blocking static signals were detected.

References

OSV advisory OpenSSF JSON

Source & flagged code

5 flagged · loading source

bin/conductor-update.jsView file

9import fs from "node:fs"; L10: import { spawn } from "node:child_process"; L11: import process from "node:process";

High

Child Process

Package source references child process execution.

bin/conductor-update.jsView on unpkg · L9

199stdio: "inherit", L200: shell: true L201: });

High

Shell

Package source references shell execution.

bin/conductor-update.jsView on unpkg · L199

bin/conductor.jsView file

35const consoleImpl = deps.console || console; L36: const importModule = deps.importModule || ((subcommandPath) => import(subcommandPath)); L37: const env = deps.env || process.env;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/conductor.jsView on unpkg · L35

bin/conductor-fire.jsView file

40const __filename = fileURLToPath(import.meta.url); L41: const __dirname = path.dirname(__filename); L42: const PKG_ROOT = path.join(__dirname, ".."); ... L46: L47: export function isLaunchedByDaemon(env = process.env) { L48: const daemonHostedValue = ... L67: L68: const pkgJson = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf-8")); L69: const CLI_NAME = (process.env.CONDUCTOR_CLI_NAME || path.basename(process.argv[1] || "conductor-fire")).replace( ... L495: this.logger( L496: `[watchdog] Backend websocket healthy again after self-heal via ${signal} (${formatFireWatchdogState({ L497: connectedAt: this.lastConnectedAt,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/conductor-fire.jsView on unpkg · L40

bin/conductor-config.jsView file

50command: "chat-web", L51: execArgs: "--model chatgpt", L52: description: "Chat web (ChatGPT) via @love-moon/chat-web", ... L63: const backendUrl = L64: process.env.CONDUCTOR_BACKEND_URL || L65: process.env.BACKEND_URL || L66: "https://conductor.conductor-ai.top"; L67: const defaultDaemonName = os.hostname() || "my-daemon";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/conductor-config.jsView on unpkg · L50