Malicious code in fuels-forc (npm)

The 'fuels-forc' npm package version 1.0.0 includes malicious code in its bin/cli.js file that runs the 'whoami' command and collects system hostname and platform information. It then unconditionally sends this data along with the package name to a non-first-party hardcoded URL (https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9). This behavior indicates a dependency confusion or typosquatting attack designed to lure users into installing a malicious package resembling the legitimate Fuel Labs 'forc' toolchain. The package compromises the host system, potentially granting full control to an attacker.

Any system with 'fuels-forc' version 1.0.0 installed or running should be considered fully compromised. Attackers may have obtained full control over the system, including access to stored secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is necessary. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Remove the 'fuels-forc' package version 1.0.0 immediately. Rotate all secrets and keys stored on the affected system from a different, trusted machine. Because the package may have granted full control to an attacker, consider the system compromised and perform a thorough incident response and forensic analysis. There is no official patch or fix; avoidance and removal are the primary mitigations.