MAL-2026-13428

    Dashboard / Malicious Package / MAL-2026-13428

    MAL-2026-13428

    Published: 6 Aug 2026Last Modified: 6 Aug 2026

    Summary: Malicious code in @love-moon/conductor-cli (npm)

    Details: Source: amazon-inspector (7ea5d4f1af0a0b67e6f74bfb45867ce0b33136083138e3c23a56df03d8b5c902) The `conductor daemon` command (bin/conductor-daemon.js -> src/daemon.js) opens a WebSocket to https://conductor.conductor-ai.top (or a user-configured backend_url) and registers a message handler that, in `handleTerminalInput`, writes `payload.data` received from the server directly into a node-pty process. The PTY is spawned by `handleCreatePtyTask` running either the user's default shell (/bin/bash, /bin/zsh, cmd.exe, $SHELL) or a CLI from DEFAULT_CLI_LIST, which launches `codex --dangerously-bypass-approvals-and-sandbox` and `claude --dangerously-skip-permissions` — the same flags are written into the generated config.yaml by bin/conductor-config.js. Any party controlling the WebSocket peer (the Conductor backend, an impersonator on the network, or a compromised backend account) can drive arbitrary commands into the installer's shell or into an AI CLI whose local approval/sandbox gates have been disabled by default. The remote-command channel and the disabled-safety flags together provide full-host command execution driven by conductor-ai.top.

    References: https://www.npmjs.com/package/@love-moon/conductor-cli/v/0.7.5, https://www.npmjs.com/package/@love-moon/conductor-cli/v/0.7.4, https://www.npmjs.com/package/@love-moon/conductor-cli/v/0.8.0, https://www.npmjs.com/package/@love-moon/conductor-cli/v/0.7.6

    Affected packages

    Package

    Name: @love-moon/conductor-cli

    Purl: pkg:npm/%40love-moon/conductor-cli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.7.5
    0.7.4
    0.7.6