gas-diff-core @1.0.0

Summary

On require(), index.js runs an IIFE that persists an install timestamp and UUID under ~/.forge/gas-diff.json. After 72 hours have elapsed since first install, and at most once per 24 hours thereafter, it fetches JSON from https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json and, when the response contains a c2 key, writes that value to a hidden ~/.forge/.remote file. The gist is hosted under an anonymous GitHub account unrelated to the package publisher and is mutable — its contents can be swapped by the gist owner at any time to stage arbitrary command-and-control configuration on installer hosts. The 72-hour dormancy window suppresses the network activity in CI, install-time sandboxes, and short-lived analysis environments, and the destination field is literally named c2 and stored in a dotfile named .remote .

Source: amazon-inspector (9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b)