Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in gemini-cli-a2a-server (npm)

A malicious npm package named gemini-cli-a2a-server was published to exploit dependency confusion, mimicking a private Google internal component. The postinstall script collected host identifiers and exfiltrated them to a hardcoded external endpoint.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or CI/CD system that installed gemini-cli-a2a-server from npm, particularly those expecting a private Google Gemini CLI component.
Ecosystems
npm
Attack vectors
Dependency confusionCompromised package
Affected entities
  • gemini-cli-a2a-servernpm package containing malicious postinstall script

The npm package gemini-cli-a2a-server was published as a dependency-confusion probe targeting Google's internal Gemini CLI a2a-server component. The package name and internal references (source.txt) were designed to deceive developers or build systems into resolving the public npm package instead of the intended private dependency.\n\nUpon installation, the package's postinstall script executed automatically, collecting system and environment metadata including hostname, OS platform, architecture, Node.js version, and package lifecycle information. This data was exfiltrated via HTTPS POST requests to the hardcoded endpoint https://onpx9s3x.instances.poc.jchunt.top/gemini-cli-a2a-server.\n\nThe attack was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository. The package has been removed from npm and the incident is resolved.

Indicators of compromise

Packages
  • gemini-cli-a2a-server
Domains
  • onpx9s3x.instances.poc.jchunt.top

Remediation

  • Audit npm install logs and CI/CD pipelines for any installation of gemini-cli-a2a-server
  • Remove the package from all environments where it was installed
  • Review host identifiers and environment metadata that may have been exfiltrated
  • Implement dependency confusion detection and private package registry mirroring to prevent similar attacks
  • Use npm audit and supply chain security tools to detect malicious packages
  • Consider using package signing and verification mechanisms

Sources

  1. GitHub Advisory GHSA-x74f-m7fv-4r68 · GitHub Advisory Database

Cite this entry

"Malicious code in gemini-cli-a2a-server (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-gemini-cli-a2a-server-npm-1r7mt2

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package