gemini-cli-a2a-server

{"modified":"2026-08-19T03:50:19Z","published":"2026-08-19T03:50:19Z","schema_version":"1.7.4","id":"MAL-2026-14244","summary":"Malicious code in gemini-cli-a2a-server (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd)\nOn npm install, the package's postinstall script collects host identifiers (os.hostname(), platform, arch, Node version, and package/lifecycle metadata) and POSTs them via https.request to the hardcoded endpoint https://onpx9s3x.instances.poc.jchunt.top/gemini-cli-a2a-server. The package name mimics a private Google Gemini CLI a2a-server component, and a source.txt reference in the tarball points at that internal package — consistent with a dependency-confusion probe that pings out from any environment that inadvertently resolves this public name instead of the intended private one.\n","affected":[{"package":{"ecosystem":"npm","name":"gemini-cli-a2a-server"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"3d8b7dcf3e691ef3f2c2080cc355887469df588cdc8e8ed8c4900c4739a08de2","tlsh":"500123c5e1b9563667b8528078f1af0693bbf223370220b67ac444e93f8d1f6003219d"}],"package_integrity":[{"filename":"gemini-cli-a2a-server-1.0.0.tgz","hashes":{"sha1":"eaac6b86b4fe6bc458c7518b86cc7c46fa40509f","sha512_sri":"sha512-nV+ktH00bzrxk31+S4DKA/50Lj7Av1L7zwS5zHIwe5D73g3FwomdcsZH2NaF58R01U2WzsOgNHlUw59vxZjMMQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gemini-cli-a2a-server/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018341","import_time":"2026-08-19T04:18:13.537656108Z","modified_time":"2026-08-19T03:50:19Z","sha256":"5eb13d8d28e4c8363ceabe294b988cd42a82f1875af3f2a30310232154664afd","source":"amazon-inspector","versions":["1.0.0"]}]}}