Malicious code in gpt-terminal-cli (npm)

gpt-terminal-cli is an npm package that advertises itself as an AI chat CLI but contains embedded malicious code. Upon installation, the package's postinstall script (scripts.postinstall) executes src/postinstall.js, which spawns src/implant/loader.js as a detached background daemon with persistence mechanisms.\n\nThe loader implements a watchdog process that polls every 20 seconds to respawn the implant if killed, supporting up to 50 automatic revives. The implant communicates with a hardcoded C2 endpoint at http://13.60.13.215:7771 using an AES-256-GCM + HMAC-signed opcode protocol. Capabilities include remote shell execution, Python code execution, PTY shells, file download/upload, persistence installation, screenshot capture, keylogging, clipboard theft, webcam access, microphone access, browser credential theft, file exfiltration, lateral movement, privilege escalation, and antiforensics.\n\nThe implant opens a WebSocket connection to /pty/ on the C2 host and pipes remote base64-decoded commands into cmd.exe (Windows) or /bin/bash (Unix), with output relayed back to the attacker. On Windows, the implant prepends AMSI-bypass reflection stubs to PowerShell invocations to evade detection. The C2 infrastructure supports dynamic rotation: the implant polls DNS TXT records on a dead-drop domain every 30 minutes to update the C2 URL and HMAC secret at runtime, enabling attacker infrastructure changes without package updates.\n\nThe package was identified via Amazon Inspector and reported to GitHub Advisories (GHSA-x33m-j487-w85g).