MalwarePublished 7 Aug 2026

gas-diff-core (npm) · Malicious Code

Affects gas-diff-coreSource GCVE Database

Malicious package : remove gas-diff-core and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13517

What to do

Remove gas-diff-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmgas-diff-core	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package gas-diff-core version 1.0.0 contains malicious code that, upon being required, executes a script persisting an install timestamp and UUID locally. After 72 hours, it periodically fetches JSON data from a mutable GitHub Gist controlled by an anonymous account unrelated to the package publisher. If the fetched JSON contains a 'c2' key, its value is written to a hidden local file, enabling command-and-control (C2) configuration. The 72-hour delay is designed to evade detection in short-lived environments such as CI pipelines or sandboxes.

Impact

This malicious behavior enables remote attackers to establish command-and-control communication with compromised systems via a dynamically controlled configuration fetched from an external source. The delayed activation reduces the likelihood of detection during automated scans or sandbox analysis. This can lead to persistent unauthorized control over affected systems where the package is installed.

Defensive guidance

Users should immediately remove the gas-diff-core package version 1.0.0 from their environments and avoid installing it. Monitor for and delete the hidden files '~/.forge/gas-diff.json' and '~/.forge/.remote' if present. Since the malicious payload fetches configuration from an external mutable source, network controls blocking access to the specified GitHub Gist URL can help mitigate risk. Check vendor advisories or trusted security sources for updates on remediation.

Summary

The gas-diff-core npm package (version 1.0.0) includes an immediately invoked function expression (IIFE) in its index.js that records installation metadata locally. After a dormancy period of 72 hours, it fetches a JSON payload from a mutable GitHub Gist URL. If the payload contains a 'c2' field, the value is saved to a hidden file named '.remote' under the user's home directory. This mechanism allows the attacker controlling the Gist to remotely configure command-and-control parameters on compromised hosts. The use of a delayed activation and a hidden file aims to bypass detection in automated analysis environments.

References

npmjs.com/package/gas-diff-core/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:49 UTC

Technical details

References

Community reviews