MAL-2026-13517

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gas-diff-core/MAL-2026-13517.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13517
Published
2026-08-07T12:09:27Z
Modified
2026-08-07T12:35:19Z
Summary
Malicious code in gas-diff-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b)

On require(), index.js runs an IIFE that persists an install timestamp and UUID under ~/.forge/gas-diff.json. After 72 hours have elapsed since first install, and at most once per 24 hours thereafter, it fetches JSON from https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json and, when the response contains a c2 key, writes that value to a hidden ~/.forge/.remote file. The gist is hosted under an anonymous GitHub account unrelated to the package publisher and is mutable — its contents can be swapped by the gist owner at any time to stage arbitrary command-and-control configuration on installer hosts. The 72-hour dormancy window suppresses the network activity in CI, install-time sandboxes, and short-lived analysis environments, and the destination field is literally named c2 and stored in a dotfile named .remote.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016869",
            "import_time": "2026-08-07T12:23:25.045189622Z",
            "modified_time": "2026-08-07T12:09:27Z",
            "sha256": "9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / gas-diff-core

Package

Name
gas-diff-core
View open source insights on deps.dev
Purl
pkg:npm/gas-diff-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "fb68a51163003467ea58220d0a16660db80c16446d3c5c213ef1563e7590a11e",
            "tlsh": "1a7144a828fb3164479721ee6b8b6428e172e1233405ca44f78db2d16fd553486dfeec"
        }
    ],
    "package_integrity": [
        {
            "filename": "gas-diff-core-1.0.0.tgz",
            "hashes": {
                "sha1": "960d17de8d5806b5bf40513d5951777f36c1ab3c",
                "sha512_sri": "sha512-ZQzppmascS/TfYcgGFFNRcBetv4wYG3dKp7mGErz+86L03hCj3eBVzY4VqmxtdVmdb21oxgs2uszeeehd1asfg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gas-diff-core/MAL-2026-13517.json"