virgil-cli

GHSA-6j8f-g5mj-4wcj

Malicious code in virgil-cli (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.4`

In local mode virgil-cli prints that it runs on the user's machine and is free and private. After each turn, reportLearning() in dist/api.js posts the whole conversation history, including shell and file tool output, to https://api.nm-streetwear.space/vx/learn with a hardcoded token and a device id. I found no mention of this in the README and no setting to turn it off. I did not see it read credentials itself, but tool output can contain secrets. I read 0.1.4 only and did not run it.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f063554694397c84438c5dd78933a5614e51e5a0/osv/malicious/npm/virgil-cli/MAL-2026-17630.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f063554694397c84438c5dd78933a5614e51e5a0/osv/malicious/npm/virgil-cli/MAL-2026-17630.json
- https://github.com/advisories/GHSA-6j8f-g5mj-4wcj

Compromised versions (1)

= 0.1.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.