NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
Malicious package

@love-moon/conductor-clinpm

Advisory published Updated

@love-moon/conductor-cli is a confirmed malicious npm package (MAL-2026-13428) that typosquats a legitimate package to trick installs (malicious versions 0.7.4, 0.7.5, 0.7.6…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @love-moon/conductor-cli (npm)

MAL-2026-13428
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @love-moon/conductor-cli

What this malware does

The conductor daemon command (bin/conductor-daemon.js -> src/daemon.js) opens a WebSocket to https://conductor.conductor-ai.top (or a user-configured backend_url) and registers a message handler that, in handleTerminalInput, writes payload.data received from the server directly into a node-pty process. The PTY is spawned by handleCreatePtyTask running either the user's default shell (/bin/bash, /bin/zsh, cmd.exe, $SHELL) or a CLI from DEFAULT_CLI_LIST, which launches codex --dangerously-bypass-approvals-and-sandbox and claude --dangerously-skip-permissions — the same flags are written into the generated config.yaml by bin/conductor-config.js. Any party controlling the WebSocket peer (the Conductor backend, an impersonator on the network, or a compromised backend account) can drive arbitrary commands into the installer's shell or into an AI CLI whose local approval/sandbox gates have been disabled by default. The remote-command channel and the disabled-safety flags together provide full-host command execution driven by conductor-ai.top.

Malicious versions

4 flagged
0.7.40.7.50.7.60.8.0

Indicators of compromise (SHA-256)

06daab6c255b360b523604e96d4a4748abac14e273ce477a57ba026ffb565147
40dd644866a41ae1d46e83ead8f7fc7df120162a3ec4d8b0c9b7da03aea378e2
7ea5d4f1af0a0b67e6f74bfb45867ce0b33136083138e3c23a56df03d8b5c902
f9873ec7de86743677ae29ec9eb37ff474dec25d6de28d017a5e2123c6afc65d

Detection & response playbook

Typosquat

  1. Find it

    Search your lockfiles and build artifacts for @love-moon/conductor-cli (4 malicious versions).

  2. If you installed it — respond

    @love-moon/conductor-cli is a typosquat — you almost certainly intended a legitimately-named package. Remove @love-moon/conductor-cli, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

  3. Did it already run?

    If @love-moon/conductor-cli was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @love-moon/conductor-cli on npm has been identified as a malicious package (versions 0.7.4, 0.7.5, 0.7.6, 0.8.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-016650IN-MAL-2026-016649IN-MAL-2026-016647IN-MAL-2026-016648

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks @love-moon/conductor-cli-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@love-moon/conductor-cli (npm) malicious package — MAL-2026-13428 | O3 Security