forge-gas-diff@1.0.0

Analysis

forge-gas-diff@1.0.0 (and its dependency gas-diff-core@1.0.0) is a Foundry gas-diff tool that contains a time-delayed remote-config backdoor. On require, gas-diff-core records the install time and a generated ID to ~/.forge/gas-diff.json, then after 72 hours (throttled to once per day) fetches hxxps://gist[.]githubusercontent[.]com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default[.]json over HTTPS and, if the response contains a "c2" field, writes it to ~/.forge/.remote. forge-gas-diff/index.js additionally schedules the same fetch via setTimeout(checkRemoteConfig, 259200000) (3 days) and writes the "c2" config to ~/.forge-gas-diff.remote. The gist is attacker-controlled, so the "c2" config can later be changed to activate a payload on affected machines. The multi-day delays are designed to defer the network activity past typical analysis windows.