Malicious code in fuels-versions (npm)

The 'fuels-versions' npm package version 1.0.0 includes a malicious script in its bin/cli.js file that contains a hardcoded out-of-band callback URL. When executed, it collects the installer's username (via os.userInfo() or whoami), hostname, and platform information, then POSTs this data to https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9. This behavior indicates a dependency confusion or typosquatting attack designed to beacon host identity information. The package mimics the Fuel Labs ecosystem to increase the likelihood of installation. According to the GHSA malware advisory, any system with this package installed or running should be treated as fully compromised, necessitating immediate secret and key rotation from a clean environment. The advisory warns that removing the package may not fully remove all malicious artifacts.

Installation or execution of the 'fuels-versions' package version 1.0.0 results in exfiltration of sensitive host information (username, hostname, platform) to an attacker-controlled endpoint. The compromise is considered severe enough that the entire system should be treated as fully compromised, implying potential for further undetected malicious activity. Secrets and keys stored on the affected system are at risk and must be rotated. The presence of this package indicates a successful supply chain attack via typosquatting or dependency confusion.

Remove the 'fuels-versions' package version 1.0.0 immediately from all affected systems. Treat any system that installed or ran this package as fully compromised. Rotate all secrets, keys, and credentials from a separate, secure environment. Conduct a thorough investigation for additional malicious artifacts or persistence mechanisms. There is no official patch or fix for this malicious package; remediation relies on removal and incident response.