Malicious code in fuels-core (npm)

The 'fuels-core' npm package version 1.0.0 includes a malicious bin script ('bin/cli.js') that collects sensitive system information (user identity, hostname, platform) and posts it to a hardcoded Cloudflare Workers URL. This package name mimics legitimate Fuel ecosystem packages, suggesting it is used for typosquatting or dependency confusion attacks targeting users who install or invoke it (e.g., via 'npx'). The package's behavior is explicitly described in its package.json as sending package name and user information to an out-of-band callback. Security analyses classify this package as malicious due to its communication with a domain linked to malicious activity and execution of commands associated with malicious behavior. Systems with this package installed should be considered fully compromised.

Systems with 'fuels-core' version 1.0.0 installed or running are considered fully compromised. The package exfiltrates system information to an attacker-controlled endpoint, potentially enabling further malicious actions. Because the package may grant an attacker full control, all secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently documented for this malicious package. Immediate removal of the 'fuels-core' package version 1.0.0 is recommended. Due to the high risk of full system compromise, all credentials and secrets on the affected system should be rotated from a secure environment. Users should avoid installing packages with suspicious or typosquatting names and verify package authenticity before installation. Monitor for any unusual activity and consider rebuilding compromised systems if possible.