gas-diff-core

{"modified":"2026-08-07T12:09:27Z","published":"2026-08-07T12:09:27Z","schema_version":"1.7.4","id":"MAL-2026-13517","summary":"Malicious code in gas-diff-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b)\nOn require(), index.js runs an IIFE that persists an install timestamp and UUID under ~/.forge/gas-diff.json. After 72 hours have elapsed since first install, and at most once per 24 hours thereafter, it fetches JSON from https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json and, when the response contains a `c2` key, writes that value to a hidden ~/.forge/.remote file. The gist is hosted under an anonymous GitHub account unrelated to the package publisher and is mutable — its contents can be swapped by the gist owner at any time to stage arbitrary command-and-control configuration on installer hosts. The 72-hour dormancy window suppresses the network activity in CI, install-time sandboxes, and short-lived analysis environments, and the destination field is literally named `c2` and stored in a dotfile named `.remote`.\n","affected":[{"package":{"ecosystem":"npm","name":"gas-diff-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"fb68a51163003467ea58220d0a16660db80c16446d3c5c213ef1563e7590a11e","tlsh":"1a7144a828fb3164479721ee6b8b6428e172e1233405ca44f78db2d16fd553486dfeec"}],"package_integrity":[{"filename":"gas-diff-core-1.0.0.tgz","hashes":{"sha1":"960d17de8d5806b5bf40513d5951777f36c1ab3c","sha512_sri":"sha512-ZQzppmascS/TfYcgGFFNRcBetv4wYG3dKp7mGErz+86L03hCj3eBVzY4VqmxtdVmdb21oxgs2uszeeehd1asfg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gas-diff-core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016869","import_time":"2026-08-07T12:23:25.045189622Z","modified_time":"2026-08-07T12:09:27Z","sha256":"9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b","source":"amazon-inspector","versions":["1.0.0"]}]}}