Malicious code in gas-diff-core (npm)
The npm package gas-diff-core contained malicious code that persists an install timestamp and UUID, then fetches command-and-control configuration from a mutable GitHub gist after 72 hours. The 72-hour delay was designed to evade detection in CI/sandbox environments.
- Disclosed
- Last updated
- Blast radius
- All systems that installed the malicious gas-diff-core package
- Ecosystems
- Attack vectors
- Affected entities
- gas-diff-corenpm package containing malicious code
The npm package gas-diff-core was found to contain malicious code in its index.js file. Upon require(), an IIFE (Immediately Invoked Function Expression) executes and persists an install timestamp and UUID to ~/.forge/gas-diff.json.\n\nAfter 72 hours have elapsed since initial installation, and at most once per 24 hours thereafter, the malicious code fetches JSON from a GitHub gist (https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json) hosted under an anonymous account unrelated to the package publisher. When the response contains a c2 key, the value is written to a hidden ~/.forge/.remote file for command-and-control purposes.\n\nThe 72-hour dormancy window was designed to suppress network activity during CI runs, install-time sandboxes, and short-lived analysis environments, making detection more difficult. The gist is mutable, allowing the attacker to swap its contents at any time to stage arbitrary C2 configuration on compromised hosts.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- gas-diff-core
- Domains
- gist.githubusercontent.com
Remediation
- Immediately uninstall gas-diff-core from all systems
- Audit ~/.forge/ directories on affected systems for the presence of gas-diff.json and .remote files
- Review network logs for outbound connections to gist.githubusercontent.com from the 72-hour post-installation window onwards
- Check for any unauthorized command-and-control activity or lateral movement from affected hosts
- Update dependency manifests to remove gas-diff-core and use a legitimate alternative if available
- Implement package integrity verification and supply chain security scanning in CI/CD pipelines
Sources
- GitHub Advisory GHSA-hw2f-c6r2-4cmc · GitHub Advisory Database
Cite this entry
"Malicious code in gas-diff-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-gas-diff-core-npm-c2sjh8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in bolt-delivery-menu-app
The npm package bolt-delivery-menu-app contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in agentsync-pkg
Malware discovered in the npm package agentsync-pkg. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in anthropic-setup
The npm package anthropic-setup contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in sui-gql-core
Malware was discovered in the npm package sui-gql-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package