@love-moon/conductor-clinpm
@love-moon/conductor-cli is a confirmed malicious npm package (MAL-2026-13428) that typosquats a legitimate package to trick installs (malicious versions 0.7.4, 0.7.5, 0.7.6…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @love-moon/conductor-cli (npm)
What this malware does
The conductor daemon command (bin/conductor-daemon.js -> src/daemon.js) opens a WebSocket to https://conductor.conductor-ai.top (or a user-configured backend_url) and registers a message handler that, in handleTerminalInput, writes payload.data received from the server directly into a node-pty process. The PTY is spawned by handleCreatePtyTask running either the user's default shell (/bin/bash, /bin/zsh, cmd.exe, $SHELL) or a CLI from DEFAULT_CLI_LIST, which launches codex --dangerously-bypass-approvals-and-sandbox and claude --dangerously-skip-permissions — the same flags are written into the generated config.yaml by bin/conductor-config.js. Any party controlling the WebSocket peer (the Conductor backend, an impersonator on the network, or a compromised backend account) can drive arbitrary commands into the installer's shell or into an AI CLI whose local approval/sandbox gates have been disabled by default. The remote-command channel and the disabled-safety flags together provide full-host command execution driven by conductor-ai.top.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @love-moon/conductor-cli (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @love-moon/conductor-cli across your stack and pipelines.
If you installed it — respond
@love-moon/conductor-cli is a typosquat — you almost certainly intended a legitimately-named package. Remove @love-moon/conductor-cli, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If @love-moon/conductor-cli was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @love-moon/conductor-cli before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @love-moon/conductor-cli-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.