MAL-2026-13517 Malicious code in gas-diff-core (npm)

On require(), index.js runs an IIFE that persists an install timestamp and UUID under ~/.forge/gas-diff.json. After 72 hours have elapsed since first install, and at most once per 24 hours thereafter, it fetches JSON from https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json and, when the response contains a c2 key, writes that value to a hidden ~/.forge/.remote file. The gist is hosted under an anonymous GitHub account unrelated to the package publisher and is mutable — its contents can be swapped by the gist owner at any time to stage arbitrary command-and-control configuration on installer hosts. The 72-hour dormancy window suppresses the network activity in CI, install-time sandboxes, and short-lived analysis environments, and the destination field is literally named c2 and stored in a dotfile named .remote.