Malicious code in gas-diff-core (npm)
The npm package gas-diff-core version 1.0.0 contains malicious code that, upon being required, executes a script persisting an install timestamp and UUID locally. After 72 hours, it periodically fetches JSON data from a mutable GitHub Gist controlled by an anonymous account unrelated to the package publisher. If the fetched JSON contains a 'c2' key, its value is written to a hidden local file, enabling command-and-control (C2) configuration. The 72-hour delay is designed to evade detection in short-lived environments such as CI pipelines or sandboxes.
AI Analysis
Technical Summary
The gas-diff-core npm package (version 1.0.0) includes an immediately invoked function expression (IIFE) in its index.js that records installation metadata locally. After a dormancy period of 72 hours, it fetches a JSON payload from a mutable GitHub Gist URL. If the payload contains a 'c2' field, the value is saved to a hidden file named '.remote' under the user's home directory. This mechanism allows the attacker controlling the Gist to remotely configure command-and-control parameters on compromised hosts. The use of a delayed activation and a hidden file aims to bypass detection in automated analysis environments.
Potential Impact
This malicious behavior enables remote attackers to establish command-and-control communication with compromised systems via a dynamically controlled configuration fetched from an external source. The delayed activation reduces the likelihood of detection during automated scans or sandbox analysis. This can lead to persistent unauthorized control over affected systems where the package is installed.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the gas-diff-core package version 1.0.0 from their environments and avoid installing it. Monitor for and delete the hidden files '~/.forge/gas-diff.json' and '~/.forge/.remote' if present. Since the malicious payload fetches configuration from an external mutable source, network controls blocking access to the specified GitHub Gist URL can help mitigate risk. Check vendor advisories or trusted security sources for updates on remediation.
Malicious code in gas-diff-core (npm)
Description
The npm package gas-diff-core version 1.0.0 contains malicious code that, upon being required, executes a script persisting an install timestamp and UUID locally. After 72 hours, it periodically fetches JSON data from a mutable GitHub Gist controlled by an anonymous account unrelated to the package publisher. If the fetched JSON contains a 'c2' key, its value is written to a hidden local file, enabling command-and-control (C2) configuration. The 72-hour delay is designed to evade detection in short-lived environments such as CI pipelines or sandboxes.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The gas-diff-core npm package (version 1.0.0) includes an immediately invoked function expression (IIFE) in its index.js that records installation metadata locally. After a dormancy period of 72 hours, it fetches a JSON payload from a mutable GitHub Gist URL. If the payload contains a 'c2' field, the value is saved to a hidden file named '.remote' under the user's home directory. This mechanism allows the attacker controlling the Gist to remotely configure command-and-control parameters on compromised hosts. The use of a delayed activation and a hidden file aims to bypass detection in automated analysis environments.
Potential Impact
This malicious behavior enables remote attackers to establish command-and-control communication with compromised systems via a dynamically controlled configuration fetched from an external source. The delayed activation reduces the likelihood of detection during automated scans or sandbox analysis. This can lead to persistent unauthorized control over affected systems where the package is installed.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the gas-diff-core package version 1.0.0 from their environments and avoid installing it. Monitor for and delete the hidden files '~/.forge/gas-diff.json' and '~/.forge/.remote' if present. Since the malicious payload fetches configuration from an external mutable source, network controls blocking access to the specified GitHub Gist URL can help mitigate risk. Check vendor advisories or trusted security sources for updates on remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13517
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75f712bf8831d53984fc2d
Added to database: 08/07/2026, 15:17:38 UTC
Last enriched: 08/07/2026, 15:49:42 UTC
Last updated: 08/07/2026, 15:49:42 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.