stella-ai-cli
This report shows the evidence for stella-ai-cli@3.0.1. 8 of 9 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-10133 confirms this npm version as malicious.
Advisory
MAL-2026-10133
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in stella-ai-cli (npm)
Details
The `stella` CLI shipped in bin/stella.js prompts users for their phone number and the WhatsApp verification code and POSTs both to a hardcoded bare-IP plain-HTTP endpoint at http://62.238.2.22:8787 (paths /api/v1/auth/register/register and /verify). Subsequent chat input is sent to the same host. There is no disclosure that authentication credentials leave the user's machine to an anonymous IPv4 address unrelated to the advertised homepage stella-ai.app. In addition, bin/postinstall.js and install.bat implement a dropper flow that downloads stella-latest.tar.gz from the same bare-IP plain-HTTP endpoint, extracts it under ~/.stella, installs the Bun runtime via `curl -fsSL https://bun.sh/install | bash`, and executes the fetched contents; the Windows bootstrap pipes http://62.238.2.22:8787/install.ps1 directly into `iex`. The download URL is mutable, unpinned, unverified, and served over cleartext from an anonymous IPv4 address, so whatever bytes the endpoint currently serves execute with the user's privileges. Package metadata reinforces the mismatch: homepage stella-ai.app, repository github.com/anomalyco/opencode, operational endpoint a raw IPv4.
## Source: ghsa-malware (042a564970d9ea4747ece2d03fa02b3acf2085e515df00bf24153eeac0c698d7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Static inspection shows risky credential handling, but the credential flow is user-invoked and aligned with the advertised Stella CLI authentication path rather than covert malware behavior. Because the default endpoint is unauthenticated HTTP to a hardcoded IP and plaintext secrets are stored, downgrade to warn rather than mark clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs stella login or interactive stella chat; bot.js only if manually executed.
Impact
Potential exposure of Stella service credentials/token due plaintext local storage and default HTTP transport, but no evidence of unrelated credential theft or covert exfiltration.
Mechanism
user-invoked service auth and LLM API client with insecure credential handling
AI rationale
Static inspection shows risky credential handling, but the credential flow is user-invoked and aligned with the advertised Stella CLI authentication path rather than covert malware behavior. Because the default endpoint is unauthenticated HTTP to a hardcoded IP and plaintext secrets are stored, downgrade to warn rather than mark clean.
Evidence
package.jsonbin/stella.jsbot.js~/.stella/config.json
Network endpoints4
62.238.2.22:8787t.me/ofical_stellabot127.0.0.1:8788telegra.ph/Polzovatelskoe-soglashenie-06-26-600
Independent scan evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- bin/stella.js prompts for login/password and POSTs them to /api/v1/auth/login on default http://62.238.2.22:8787.
- bin/stella.js persists login, password, token, and user under ~/.stella/config.json in plaintext.
- bot.js contains a hardcoded Telegram bot token and starts polling if manually executed.
Evidence against
- package.json has no lifecycle scripts; install/import does not execute code automatically.
- Only declared bin is bin/stella.js; risky network calls require user running stella login/chat.
- No child_process, eval/vm/Function, native loading, persistence, destructive behavior, or project/AI-agent control-surface writes found.
- Network calls are aligned with the package's advertised CLI assistant/auth functionality; no harvesting of unrelated env/files observed.
- bot.js is not declared as bin/main and its HUB_URL defaults to localhost.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
1 flagged · loading sourcebot.jsView file
2L3: const BOT_TOKEN = process.env.BOT_TOKEN || "8757382004:AAF7A1_weZlvg4YtHGO1emYiFY4itYf2h0w"
L4: const HUB_URL = process.env.HUB_URL || "http://127.0.0.1:8788"
L5: const bot = new TelegramBot(BOT_TOKEN, { polling: true })
...
L19: if (token) headers["Authorization"] = `Bearer ${token}`
L20: return fetch(`${HUB_URL}${path}`, { method, headers, body: body ? JSON.stringify(body) : undefined }).then(r => r.json()).catch(e => ({ ok: false, error: e.message }))
L21: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bot.jsView on unpkg · L2Findings
1 Critical2 Medium3 Low
CriticalCredential Exfiltrationbot.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to stella-ai-cli@3.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing stella-ai-cli@3.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.