Malicious code in forge-gas-diff (npm)

The npm package forge-gas-diff, published under the account danird9, contained undocumented malicious code disguised as a legitimate Foundry gas-report diff utility. Upon module load or CLI execution, the package scheduled a setTimeout callback for 259,200,000 milliseconds (3 days) that would perform an HTTPS GET request to a GitHub gist hosted on an unrelated account (opensource-crypto).

The malicious behavior included: (1) fetching remote configuration from an attacker-controlled gist at https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json; (2) persisting any c2 field from the fetched JSON to ~/.forge-gas-diff.remote for later use; (3) generating and storing a per-host UUID in ~/.forge-gas-diff as a stable install fingerprint. None of this functionality relates to the advertised gas-diff utility purpose.

The 3-day delay was designed to evade typical install-time sandboxing, while the use of an author-mutable GitHub gist provided an attacker-controlled update channel that could be modified without republishing the package. This architecture represents a staging mechanism for a remote-config-driven dropper, establishing persistence and fingerprinting infrastructure on infected systems.

The malicious package was identified and reported by the OpenSSF.