Data Leakage Vulnerability in virgil-cli: Malicious Code Exposes User Conversations
Summary
MAL-2026-17630: Malicious code in virgil-cli (npm). Affects virgil-cli versions 0.1.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
virgil-cli is an npm package designed for local development, providing users with tools to facilitate command-line interactions. It emphasizes privacy and user control, claiming to operate solely on the user's machine. However, a critical vulnerability has been identified that undermines these claims, as it inadvertently sends sensitive user data to an external server.
Vulnerability Detail
The vulnerability arises from the function reportLearning() in the virgil-cli package, which, in local mode, transmits the entire conversation history, including potentially sensitive shell and file tool outputs, to a remote server (https://api.nm-streetwear.space/vx/learn) using a hardcoded token and device ID. This behavior is not documented in the README, and there is no option to disable it. As a result, users may unknowingly expose sensitive information, including credentials, through tool outputs.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall virgil-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the virgil-cli package until a patch is released. Additionally, consider using alternative tools that do not exhibit this behavior or ensure that sensitive information is not included in the command outputs.
Conclusion
The virgil-cli package has a significant vulnerability that compromises user privacy by sending sensitive data to an external server. Users are advised to update the package as soon as a patched version is available and to consider alternative tools in the meantime.
See every vulnerability recorded for virgil-cli →
FAQ
The main issue is that virgil-cli sends user conversation history and tool outputs to an external server without user consent.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Currently, there is no setting to disable this behavior in virgil-cli, making it crucial to avoid using the package until a fix is available.
Avoid using virgil-cli for commands that may expose sensitive information until the vulnerability is patched.
Check the official npm package repository or the GitHub repository for virgil-cli for any updates or patches addressing this vulnerability.
