The gemini-cli-a2a-server package on npm, specifically version 1.0.0, includes a postinstall script that gathers host identifiers such as hostname, platform, architecture, Node.js version, and package metadata. This data is sent via HTTPS POST to a hardcoded endpoint (https://onpx9s3x.instances.poc.jchunt.top/gemini-cli-a2a-server). The package name and a reference to an internal source file indicate it is designed to impersonate a private Google Gemini CLI component. This behavior aligns with a dependency confusion attack, where a malicious public package is published with the same name as a private internal package, causing unintended installations and data exfiltration.

This malicious package can leak sensitive environment information from any system where it is installed, potentially exposing internal host details and metadata to an attacker-controlled server. While no direct code execution beyond the postinstall script is described, the exfiltration of environment data can aid further targeted attacks or reconnaissance.

Users should avoid installing the gemini-cli-a2a-server package version 1.0.0 from public npm repositories. Verify package sources and names carefully to prevent dependency confusion attacks. Since no official patch or fix is indicated, the best mitigation is to remove or avoid this package and use verified internal packages. Monitor for any unexpected network connections to unknown endpoints during package installation.