MAL-2026-13517
Dashboard / Malicious Package / MAL-2026-13517
MAL-2026-13517
Summary: Malicious code in gas-diff-core (npm)
Details: Source: amazon-inspector (9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b) On require(), index.js runs an IIFE that persists an install timestamp and UUID under ~/.forge/gas-diff.json. After 72 hours have elapsed since first install, and at most once per 24 hours thereafter, it fetches JSON from https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json and, when the response contains a `c2` key, writes that value to a hidden ~/.forge/.remote file. The gist is hosted under an anonymous GitHub account unrelated to the package publisher and is mutable — its contents can be swapped by the gist owner at any time to stage arbitrary command-and-control configuration on installer hosts. The 72-hour dormancy window suppresses the network activity in CI, install-time sandboxes, and short-lived analysis environments, and the destination field is literally named `c2` and stored in a dotfile named `.remote`.
Affected packages
Package
Name: gas-diff-core
Purl: pkg:npm/gas-diff-core
Affected ranges
Type: N/A
Events:
