registry / Persistence / gas-diff-core
gas-diff-core
Core gas analysis engine for Foundry projects
This report shows the evidence for gas-diff-core@1.0.0. 1 of 3 known versions is blocked or flagged. The newest version, 1.0.2, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe delayed import-time network fetch and hidden remote-config write are concrete, nonessential attack behavior. No lifecycle hook is required because normal module use triggers it.
Static reason
No blocking static signals were detected.
Trigger
Any runtime import/require of index.js; remote check activates after 72 hours.
Impact
Creates covert user-home state and accepts attacker-controlled remote configuration for later use.
Mechanism
Import-time persistence plus delayed remote configuration staging.
Attack narrative
The package's main entrypoint executes immediately on import, fingerprints/persists a UUID in ~/.forge, then after a delay downloads a remote JSON file daily. A c2-bearing response is silently saved as ~/.forge/.remote, creating covert persistence and a staged remote-control configuration channel unrelated to gas-report parsing.
AI rationale
The delayed import-time network fetch and hidden remote-config write are concrete, nonessential attack behavior. No lifecycle hook is required because normal module use triggers it.
Evidence
package.jsonindex.js~/.forge/gas-diff.json~/.forge/.remote
Network endpoints1
gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js runs an IIFE at module import.
- It writes install timestamp and UUID to ~/.forge/gas-diff.json.
- After 72 hours it fetches a remote JSON configuration daily.
- If remote config has c2, it writes hidden ~/.forge/.remote.
Evidence against
- package.json has no lifecycle scripts.
- Exported gas-report functions are otherwise local parsing/comparison utilities.
Behavioral surface
CryptoFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourceforge/gas-diff.jsonView file
•Published source reference
High
Ai Review Evidence
It writes install timestamp and UUID to ~/.forge/gas-diff.json.
forge/gas-diff.jsonView on unpkgFindings
4 High1 Medium3 Low
HighAi Review Evidence
HighAi Review Evidenceforge/gas-diff.json
HighAi Review Evidence
HighAi Review Evidence
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gas-diff-core@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing gas-diff-core@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.