Malicious code in verify-contract-ethers (npm)

The 'verify-contract-ethers' npm package (version 1.0.0) includes a malicious binary 'fuels-typegen' that, when run, executes the 'whoami' command and posts sensitive system information including package name, username, hostname, and platform to a hardcoded external callback URL hosted on Cloudflare Workers. The package name and binary name mismatch suggests an attempt at typosquatting or dependency confusion targeting legitimate packages such as 'fuels-typegen' or 'verify-contract'. The package's declared description openly admits to this data exfiltration behavior and contains no legitimate functionality. This behavior was identified by multiple sources including Amazon Inspector, the OpenSSF Package Analysis project, and the GitHub Security Advisory malware database.

Any system with this package installed or running should be considered fully compromised. The package exfiltrates sensitive system information to an attacker-controlled endpoint, potentially enabling further malicious activity. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted environment. Removal of the package alone may not fully remediate the compromise due to potential additional malicious software installed.

Immediate removal of the 'verify-contract-ethers' package version 1.0.0 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a different, secure machine. Because the package grants potential full control to an attacker, a full system compromise should be assumed, and incident response procedures including forensic analysis and system rebuilds should be considered. There is no official patch or fix available; remediation relies on removal and secret rotation.