MAL-2026-6375

    Dashboard / Malicious Package / MAL-2026-6375

    MAL-2026-6375

    Published: 24 Jun 2026Last Modified: 24 Jun 2026

    Summary: Malicious code in gpt-chat-cli (npm)

    Details: Source: amazon-inspector (e8890af695b137878736a36dae473487015eb1954c494fec0b5a6041f0817832) collect.js bundles a host-reconnaissance and exfiltration payload. It loads child_process, fs, os, http, and https, reads os.hostname() and os.homedir(), enumerates filesystem paths via fs.existsSync(), and POSTs the collected data to the hardcoded endpoint http://aab.sportsontheweb.net (collect.js line 13, POST at line 366). The destination is unrelated to any documented purpose of a 'GPT chat CLI' package and matches the shape of a system-information stealer. Installing this package places attacker-controlled data-collection code into the install tree.

    References: https://www.npmjs.com/package/gpt-chat-cli/v/1.0.1, https://www.npmjs.com/package/gpt-chat-cli/v/1.0.2

    Affected packages

    Package

    Name: gpt-chat-cli

    Purl: pkg:npm/gpt-chat-cli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.2