wormgpt-cli@1.0.0: Suspicious npm security report (Warn)

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13466 confirms this npm version as malicious.

Advisory

MAL-2026-13466

Source

OpenSSF Malicious Packages via OSV

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 102 KB of source, external domains: 13.60.13.215, www.apple.com

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node -e "require('./src/postinstall.js')"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('./src/postinstall.js')"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/implant/persist.jsView file

7// 3. HKLM\...\Run (system-wide if elevated) L8: // 4. Startup folder .lnk (COM shortcut via PowerShell WScript.Shell) L9: // 5. WMI permanent event subscription (nuclear — no registry, no files, survives everything) ... L15: // 3. cron @reboot L16: // 4. ~/.bashrc + ~/.bash_profile + ~/.profile injection L17: // 5. ~/.xinitrc injection (X11 sessions) ... L33: function hiddenDir() { L34: const home = os.homedir(); L35: const dir = process.platform === 'win32' L36: ? path.join(home, 'AppData', 'Roaming', 'Microsoft', 'Windows Helper') ... L90: const startupDir = path.join( L91: process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/implant/persist.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> bin/wormgpt.js -> src/implant/persist.js L7: // 3. HKLM\...\Run (system-wide if elevated) L8: // 4. Startup folder .lnk (COM shortcut via PowerShell WScript.Shell) L9: // 5. WMI permanent event subscription (nuclear — no registry, no files, survives everything) ... L15: // 3. cron @reboot L16: // 4. ~/.bashrc + ~/.bash_profile + ~/.profile injection L17: // 5. ~/.xinitrc injection (X11 sessions) ... L33: function hiddenDir() { L34: const home = os.homedir(); L35: const dir = process.platform === 'win32' L36: ? path.join(home, 'AppData', 'Roaming', 'Microsoft', 'Windows Helper') ... L90: const startupDir = path.join( L91: process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/implant/persist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/wormgpt.js -> src/implant/persist.js L7: // 3. HKLM\...\Run (system-wide if elevated) L8: // 4. Startup folder .lnk (COM shortcut via PowerShell WScript.Shell) L9: // 5. WMI permanent event subscription (nuclear — no registry, no files, survives everything) ... L15: // 3. cron @reboot L16: // 4. ~/.bashrc + ~/.bash_profile + ~/.profile injection L17: // 5. ~/.xinitrc injection (X11 sessions) ... L33: function hiddenDir() { L34: const home = os.homedir(); L35: const dir = process.platform === 'win32' L36: ? path.join(home, 'AppData', 'Roaming', 'Microsoft', 'Windows Helper') ... L90: const startupDir = path.join( L91: process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/implant/persist.jsView on unpkg · L7

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('./src/postinstall.js')"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('./src/postinstall.js')"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/implant/persist.jsView file

7// 3. HKLM\...\Run (system-wide if elevated) L8: // 4. Startup folder .lnk (COM shortcut via PowerShell WScript.Shell) L9: // 5. WMI permanent event subscription (nuclear — no registry, no files, survives everything) ... L15: // 3. cron @reboot L16: // 4. ~/.bashrc + ~/.bash_profile + ~/.profile injection L17: // 5. ~/.xinitrc injection (X11 sessions) ... L33: function hiddenDir() { L34: const home = os.homedir(); L35: const dir = process.platform === 'win32' L36: ? path.join(home, 'AppData', 'Roaming', 'Microsoft', 'Windows Helper') ... L90: const startupDir = path.join( L91: process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'),

Findings

3 Critical2 High3 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPersistence Backdoorsrc/implant/persist.js

CriticalTrigger Reachable Dangerous Capabilitysrc/implant/persist.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Persistencesrc/implant/persist.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings