Malicious code in fuels-typegen (npm)

The 'fuels-typegen' npm package version 1.0.0 contains malicious code that executes upon running its CLI. It collects sensitive system identifiers including the local username (via whoami or os.userInfo), hostname, platform, and package name, then transmits this information as JSON to a hardcoded URL (https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9). The package's manifest explicitly states its purpose is to POST identifiers to an out-of-band callback, and the CLI binary name is unrelated to the package name, indicating a likely typosquatting or dependency confusion tactic. The OpenSSF Package Analysis and Amazon Inspector sources confirm the package's malicious nature and warn that systems with this package installed should be considered fully compromised.

Systems with 'fuels-typegen' version 1.0.0 installed or running are at high risk of compromise. The package collects and exfiltrates system identifiers to an attacker-controlled endpoint, potentially enabling further malicious activity. According to the sources, any secrets or keys stored on the affected system should be considered compromised and rotated immediately. Removal of the package does not guarantee full remediation due to possible additional malicious software installed by the attacker.

Immediate removal of the 'fuels-typegen' package version 1.0.0 is recommended. However, because the system may be fully compromised, all secrets and keys stored on the affected machine should be rotated from a separate, trusted device. Comprehensive incident response and forensic analysis should be conducted to identify and remediate any additional malicious artifacts. No official patch or fix is available as this is a malicious package rather than a software vulnerability.