Which versions of gpt-terminal-cli are malicious?

The following npm versions of gpt-terminal-cli are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate gpt-terminal-cli if I installed it?

gpt-terminal-cli is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed gpt-terminal-cli — how do I know if it already compromised me?

If gpt-terminal-cli was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is gpt-terminal-cli part of a known attack campaign?

Yes — gpt-terminal-cli is associated with the IN-MAL-2026-016745 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find gpt-terminal-cli across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for gpt-terminal-cli (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging gpt-terminal-cli across your stack and pipelines.

Malicious package

gpt-terminal-clinpm

gpt-terminal-cli is a confirmed malicious npm package (MAL-2026-13447) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in gpt-terminal-cli (npm)

MAL-2026-13447

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall gpt-terminal-cli

What this malware does

Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached background daemon (WORMGPT_DAEMON=1, stdio ignored, windowsHide). loader.js additionally spawns itself with --watchdog, polling every 20s to respawn the implant if killed (up to 50 revives), providing self-healing persistence. src/protocol.js hardcodes a C2 endpoint at http://13.60.13.215:7771 and implements an AES-256-GCM + HMAC-signed opcode protocol supporting shell, pyexec, PTY, download/upload, persist, screenshot, keylog, clipboard, webcam, mic, browser credential theft, file loot, lateral movement, privilege escalation, and antiforensics. src/implant/pty.js opens a WebSocket to /pty/<victimId> on the C2 host and pipes remote base64-decoded bytes into the stdin of a spawned cmd.exe or /bin/bash, with stdout/stderr relayed back — a full reverse PTY shell. protocol.js also polls DNS TXT records on a dead-drop domain every 30 minutes to rotate the C2 URL and update the HMAC secret at runtime, enabling attacker infrastructure agility without any package update. spawnPS() prepends an AMSI-bypass reflection stub (patching amsiInitFailed) via powershell -EncodedCommand to every Windows PowerShell invocation. src/implant/stealers/ and src/implant/recon/ implement the browser credential, clipboard, keylog, and file-loot collectors wired to the OP_*_DATA response envelopes.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for gpt-terminal-cli (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging gpt-terminal-cli across your stack and pipelines.
If you installed it — respond
gpt-terminal-cli is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If gpt-terminal-cli was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks gpt-terminal-cli before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. gpt-terminal-cli on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-016745

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks gpt-terminal-cli-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database