wormgpt-cli@1.0.1

Analysis

wormgpt-cli@1.0.1 is a remote-access trojan disguised as an AI terminal assistant. Its postinstall hook silently spawns a detached background implant (src/implant/loader.js → implant.js) that beacons to C2 at hxxp://13[.]60[.]13[.]215:7771/implant (POST, AES-256-GCM encrypted, HMAC-signed envelopes; C2 pool rotatable via DNS TXT dead-drop). The implant provides: a keylogger (Windows GetAsyncKeyState via PowerShell), clipboard monitor, screenshots, webcam/mic capture, remote shell and node execution, and file download/upload. It steals saved credentials from Chrome, Edge, Brave, Opera, Vivaldi (DPAPI decrypt via PowerShell with AMSI bypass), Firefox (logins.json), and Discord (LevelDB token scan). It loots SSH private keys, ~/.aws/credentials, GCP application_default_credentials, Azure msal token cache, shell history, .git-credentials, .npmrc, ~/.docker/config.json, kubeconfig, and .env files across the home directory. It installs multi-layer persistence: on Windows via HKCU/HKLM Run keys, RunOnce, Startup .lnk, a WMI permanent event subscription, and a scheduled task; on Linux via XDG autostart, a systemd --user service (Restart=always), cron @reboot, and shell-profile injection (~/.bashrc, ~/.zshrc, ~/.profile); on macOS via a LaunchAgent and login items. It copies itself to a hidden directory (~/.cache/.system on Linux, AppData\Roaming\Microsoft\Windows Helper on Windows) and deletes the original npm source after establishing persistence. A watchdog process respawns the implant if killed.