registry / Remote code execution / gemini-computer-use / 0.4.2

gemini-computer-use@0.4.2

Turn your PC, Laptop, Server or Android phone into an autonomous execution node for Google Gemini via native MCP: 26 tools, write/edit/search, background jobs, public file and page sharing, secure reverse tunnel, self-update, and a device branch (battery,

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source inspection confirms a user-invoked installer that matches the package’s documented purpose, with no evidence of a separate malicious payload or credential theft. The direct execution of mutable remote script content remains a concrete risk, so a warning is appropriate.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the package CLI without a local maintenance subcommand.

Impact

The downloaded scripts run with the invoking user’s permissions and can install the node.

Mechanism

The CLI pipes the remote installer into PowerShell or Bash; the installer also fetches node files from its gateway or GitHub.

AI rationale

Evidence

bin/cli.jsinstall.sh

Network endpoints2

racknerd-5a24bf9.merino-carob.ts.net/install.ps1racknerd-5a24bf9.merino-carob.ts.net/install.sh

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI’s default invocation downloads the installer from a remote host and executes it directly through PowerShell or Bash without a local integrity check.
The shipped installer fetches node code from its gateway, with a GitHub fallback.
The README documents running this package through npx as an installer for a Gemini computer-use node.

Evidence against

The manifest describes the package as a Gemini computer-use node installer and has no install lifecycle hook.
The remote installer behavior is user-invoked and matches the documented setup flow.

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 5.10 KB of source, external domains: racknerd-5a24bf9.merino-carob.ts.net

Source & flagged code

7 flagged

bin/cli.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

101: `irm https://racknerd-5a24bf9.merino-carob.ts.net/install.ps1 | iex`; const ps = spawn('powershell.exe', ['-ExecutionPolicy', 'Bypass', '-Command', psCmd], { stdio: 'inherit' }); ps.on('exit', (code) => p

Medium

Ai Review Evidence

The CLI’s default invocation downloads the installer from a remote host and executes it directly through PowerShell or Bash without a local integrity check.

bin/cli.jsView on unpkg · L101

108? `curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash -s -- ${rawArgs}` : `curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash`; const sh =

Medium

Ai Review Evidence

The CLI’s default invocation downloads the installer from a remote host and executes it directly through PowerShell or Bash without a local integrity check.

bin/cli.jsView on unpkg · L108

bin/cli.js#virtual:normalized:round1View file

1#!/usr/bin/env node L2: const { spawn } = require("child_process"); L3: const fs = require("fs"); ... L27: " read-only node diagnostic: autostart interpreter, heartbeat, log tail, gateway state", L28: " exit code 0 when the node is healthy, 2 otherwise" L29: ].join("\n"), ... L49: // accepted as well. L50: const roots = [path.resolve(__dirname, ".."), path.resolve(__dirname), process.cwd()]; L51: for (const root of roots) { ... L93: function launchRemoteInstaller(args) { L94: const rawArgs = args.map(arg => `"${arg.replace(/"/g, "\\\"")}"`).join(" ");\n\n console.log("🚀 Launching Gemini Computer Use installer...");\n\n if (isWindows) {\n const psCm... L95: if (Object.prototype.hasOwnProperty.call(LOCAL_SCRIPTS, subcommand)) {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cli.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable chain: scripts.start -> bin/cli.js L1: #!/usr/bin/env node L2: const { spawn } = require("child_process"); L3: const fs = require("fs"); ... L27: " read-only node diagnostic: autostart interpreter, heartbeat, log tail, gateway state", L28: " exit code 0 when the node is healthy, 2 otherwise" L29: ].join("\n"), ... L49: // accepted as well. L50: const roots = [path.resolve(__dirname, ".."), path.resolve(__dirname), process.cwd()]; L51: for (const root of roots) { ... L93: function launchRemoteInstaller(args) { L94: const rawArgs = args.map(arg => `"${arg.replace(/"/g, "\\\"")}"`).join(" ");\n\n console.log("🚀 Launching Gemini Computer Use installer...");\n\n if (isWindows) {\n const psCm... L95: if (Object.prototype.hasOwnProperty.call(LOCAL_SCRIPTS, subcommand)) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/cli.js#virtual:normalized:round1View on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

gateway.pyView file

•path = gateway.py kind = build_helper sizeBytes = 141749 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gateway.pyView on unpkg

Source & flagged code

7 flagged · loading source

bin/cli.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

Medium

Ai Review Evidence

The CLI’s default invocation downloads the installer from a remote host and executes it directly through PowerShell or Bash without a local integrity check.

bin/cli.jsView on unpkg · L101

108? `curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash -s -- ${rawArgs}` : `curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash`; const sh =

Medium

Ai Review Evidence

The CLI’s default invocation downloads the installer from a remote host and executes it directly through PowerShell or Bash without a local integrity check.

bin/cli.jsView on unpkg · L108

Findings

2 Critical2 High4 Medium4 Low

CriticalDownload Executebin/cli.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitybin/cli.js#virtual:normalized:round1

HighChild Processbin/cli.js

HighSemantic Analysis Limitedbin/cli.js#virtual:normalized:round1

MediumShips Build Helpergateway.py

MediumStructural Risk Force Deep Review

MediumAi Review Evidencebin/cli.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to gemini-computer-use@0.4.2.

See all versions of gemini-computer-use for other recorded verdicts.

Review the evidence and your use of gemini-computer-use@0.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 04:33:51.062Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code