MAL-2026-13516

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/forge-gas-diff/MAL-2026-13516.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13516
Published
2026-08-07T12:09:35Z
Modified
2026-08-08T01:04:58.806389197Z
Summary
Malicious code in forge-gas-diff (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734)

index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms (3 days) that calls https.get against https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json. The gist is hosted on a GitHub account (opensource-crypto) unrelated to the declared package publisher (danird9). If the fetched JSON contains a c2 field, the value is persisted to ~/.forge-gas-diff.remote for later use. A separate getInstallId() routine writes a per-host UUID to ~/.forge-gas-diff, providing a stable install fingerprint. None of this behavior — outbound network fetch, install-ID generation, remote-config persistence, or a field literally named c2 — has any relationship to the advertised gas-diff functionality and is not documented in the package. The gist is author-mutable, so the content delivered to installers can be changed at any time without republishing the package; the 3-day delay places the fetch well outside typical install-time sandboxing windows. The mechanism is the staging half of a remote-config-driven dropper: a hidden update channel keyed to attacker-editable content on a third-party host, with persistence to a well-known filesystem path on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016870",
            "import_time": "2026-08-07T12:23:25.114212002Z",
            "sha256": "4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734",
            "modified_time": "2026-08-07T12:09:35Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-017199",
            "import_time": "2026-08-08T00:53:10.172517816Z",
            "sha256": "8af09f105251f3c5b76ac9a11592a9af1cfb901b073472c57362c51c0a85fd2a",
            "modified_time": "2026-08-08T00:52:29Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / forge-gas-diff

Package

Name
forge-gas-diff
View open source insights on deps.dev
Purl
pkg:npm/forge-gas-diff

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-R+o/Lsf73lMSd6jCJQdyTMLGEe2y0PlDffb+u2tciAnYdTJJ6P53CFAGHCtVn1ZZOE+rgILPaRxHBuZW/Aqd+w==",
                "sha1": "e0fa210630abe85cb00178c23a6f20276a6b8551"
            },
            "filename": "forge-gas-diff-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "8651a3e22896696142fc14d510aac386d3829d5376c2c33b4aacc56b39a7721f",
            "path": "index.js",
            "tlsh": "38712fe438fb72a0028322ed6b8b6519b131e0333009c994fa8de6916f955349797eec"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/forge-gas-diff/MAL-2026-13516.json"