Malicious code in generate-schema-ethers (npm)

The 'generate-schema-ethers' npm package version 1.0.0 contains malicious code that executes the 'whoami' command and exfiltrates sensitive system information such as the OS username, hostname, platform, and package name to a hardcoded external URL (https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9). This network communication occurs unconditionally without any user consent or configuration options. The package name mimics legitimate schema-generation tooling, indicating a typosquatting or dependency confusion attack vector. The OpenSSF Package Analysis project and other sources have flagged this package as malicious due to its unauthorized data exfiltration and command execution behavior.

Any system with this package installed or running should be considered fully compromised. The attacker may have gained full control over the affected system. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure, unaffected environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Remove the 'generate-schema-ethers' package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised system from a different, secure machine. Conduct a thorough investigation and remediation of the affected environment to identify and remove any additional malicious software or persistence mechanisms. There is no official patch or fix for this malicious package; mitigation relies on removal and credential rotation.