wormgpt-cli @1.0.8

Summary

The package's bin entries ( wormgpt-cli , wormgpt , deepholegpt , wgpt ) map to bin/victim.js , which silently spawns a detached implant on any invocation (including --help / --version ). The implant connects to a hardcoded C2 at http://13.60.13.215:7771 over an AES-256-GCM/HMAC-signed protocol with pool failover and a DNS TXT dead-drop channel ( protocol.js pollDnsDeaddrop ) that rotates the C2 URL and shared secret at runtime. On beacon, implant.js gatherInfo() collects hostname, user, OS, architecture, PID, cwd, home, LAN IP, admin flag, and a persistent victim_id, and accepts opcodes for shell/PowerShell execution, interactive PTY reverse shell, file up/download, keylogging ( GetAsyncKeyState PowerShell loop), clipboard capture, screenshots, LAN lateral-movement scanning, privilege-escalation checks, and anti-forensics wipe. stealers/browser.js reads Chrome/Edge/Brave/Opera/Vivaldi Login Data SQLite databases, decrypts DPAPI-protected passwords via PowerShell with an AMSI bypass stub ( AMSI_BYPASS_B64 base64 blob run through powershell -EncodedCommand ), parses Firefox logins.json , and regex-scans Discord/Chrome LevelDB for auth tokens ( /[\w-]{24}\.[\w-]{6}\.[\w-]{27}|mfa\.[\w-]{84}/g ), exfiltrating results via C2 opcode OP_BROWSER_DATA. persist.js installs persistence across six autostart layers per OS: Windows HKCU/HKLM Run keys, Startup.lnk, WMI __EventFilter/CommandLineEventConsumer permanent subscription, scheduled tasks, and hidden Windows Helper directories via attrib +H +S ; Linux XDG autostart, systemd --user units, @reboot crontab, shell RC injection ( .bashrc / .zshrc / .profile / .xinitrc ), and /etc/rc.local ; macOS LaunchAgent plist with KeepAlive and Login Items via osascript. loader.js runs a watchdog sibling process (poll every 20s, MAX_REVIVES = 50 ) plus uncaughtException respawn to keep the implant alive.

Source: amazon-inspector (534ea1156519b64249657c1495faacdb3cc5d8e250a00e0dc2f8fd4e991af61c)