gas-diff-core@1.0.0

No blocking static signals were detected.

Any runtime import/require of index.js; remote check activates after 72 hours.

Creates covert user-home state and accepts attacker-controlled remote configuration for later use.

Import-time persistence plus delayed remote configuration staging.

The package's main entrypoint executes immediately on import, fingerprints/persists a UUID in ~/.forge, then after a delay downloads a remote JSON file daily. A c2-bearing response is silently saved as ~/.forge/.remote, creating covert persistence and a staged remote-control configuration channel unrelated to gas-report parsing.

The delayed import-time network fetch and hidden remote-config write are concrete, nonessential attack behavior. No lifecycle hook is required because normal module use triggers it.