Supply chain · npm · High

Critical Malicious npm Package 'gas-diff-core' Targets Crypto Wallets

Threat Engine Auto-Feed · data current as of 2026-08-07

The npm package 'gas-diff-core' version 1.0.0 contains malicious code designed for crypto/wallet targeting. It establishes a dormant command-and-control channel, fetching configuration after a 72-hour delay, making detection in short-lived environments difficult. Organizations using this package are at risk of arbitrary code execution and potential compromise of sensitive assets.

  • Package: npm / gas-diff-core
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Crypto / wallet targeting

The npm package 'gas-diff-core' version 1.0.0 includes malicious code that executes upon being required. It records an installation timestamp and a unique identifier. After a 72-hour dormancy period, and then once every 24 hours, it attempts to fetch configuration from a mutable GitHub Gist. If the fetched data contains a 'c2' key, its value is written to a hidden local file, establishing a command-and-control channel.

How the attack works

This is a supply-chain attack where a legitimate-looking software package is compromised to deliver malicious capabilities. The package establishes a persistent, delayed communication channel to an external server. This allows an attacker to remotely control the compromised system by delivering arbitrary commands or configurations, potentially leading to data exfiltration, system compromise, or further payload deployment without immediate detection.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations whose CI/CD pipelines pull unpinned or latest versions of npm dependencies
  • Any system or developer workstation where 'gas-diff-core' version 1.0.0 has been installed

Conditions that increase exposure

  • Using 'gas-diff-core' version 1.0.0 as a direct or transitive dependency
  • Lack of dependency pinning or lockfiles, allowing vulnerable versions to be pulled
  • Internal package mirrors that have not been updated to exclude the malicious version
  • Environments with outbound network access to GitHub Gist that are not monitored for suspicious activity

Blast-radius scenarios

  • An attacker could achieve arbitrary command execution on systems where the package is installed, potentially leading to full system compromise.
  • Sensitive data, including cryptocurrency wallet keys or other credentials, could be exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the organization's network.
  • The delayed activation makes detection challenging in short-lived build environments, increasing the blast radius to production systems.

What to do (defensive)

Detect

  • Scan dependency trees for 'gas-diff-core' version 1.0.0.
  • Monitor network traffic for outbound connections to 'gist.githubusercontent.com' from developer machines or build servers.
  • Look for the creation of '~/.forge/gas-diff.json' and '~/.forge/.remote' files on developer workstations and build environments.

Contain

  • Immediately quarantine or isolate any systems identified with 'gas-diff-core' version 1.0.0 installed.
  • Block network access to 'gist.githubusercontent.com' from development and production environments if not explicitly required.
  • Revoke and rotate credentials (especially API keys, tokens, and wallet keys) that may have been present on compromised systems.

Remediate

  • Remove 'gas-diff-core' version 1.0.0 from all projects and environments.
  • Update all dependency manifests (package.json) to remove or replace the malicious package.
  • Rebuild affected applications and redeploy them after ensuring all dependencies are clean.
  • Implement strict dependency pinning and use lockfiles (e.g., package-lock.json) to prevent unexpected dependency updates.

Frontier verdict — High

Prioritize immediate removal of 'gas-diff-core' v1.0.0 due to critical severity and delayed command-and-control capabilities targeting crypto assets.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.