Malicious code in generate-schema-viem (npm)

The 'generate-schema-viem' npm package (version 1.0.0) masquerades as a legitimate package but contains malicious code. It exposes a CLI binary 'generate-schema-ethers' that executes the 'whoami' command, reads the operating system hostname and platform, and sends this information via an HTTP POST request to a hardcoded external URL controlled by an attacker. This represents a dependency confusion or typosquatting attack vector. The package's manifest itself labels it as an out-of-band callback, confirming its malicious intent. The OpenSSF Package Analysis and other sources have flagged this package as malicious due to its communication with a known malicious domain and execution of suspicious commands.

Installation or execution of this package results in leakage of sensitive system information (user identity, hostname, platform) to an attacker-controlled endpoint. According to the analysis, any computer with this package installed or running should be considered fully compromised, implying potential unauthorized control or presence of additional malicious software. All secrets and keys on affected systems are at risk and should be rotated immediately from a secure environment. Removal of the package alone may not fully remediate the compromise.

Immediate removal of the 'generate-schema-viem' package version 1.0.0 is recommended. All credentials, secrets, and keys stored on affected systems should be rotated from a different, trusted machine. Due to the potential full compromise of the system, a thorough security assessment and possible system rebuild may be necessary. No official patch or fix is available; the package itself is malicious and should be avoided entirely.