Findings

MAL-2026-16355

Malicious code in gemini-computer-use (npm)

Published Sep 21, 2026 · updated Oct 13, 2026

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847) The npm entrypoint bin/cli.js, invoked via or , spawns on Unix and running on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to and processes JSON-RPC messages; the handler passes the incoming field to , giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway. ## Source: ossf-package-analysis (98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887) The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.