Malicious code in verify-contract-viem (npm)

The 'verify-contract-viem' npm package version 1.0.0 includes a malicious CLI script (bin/cli.js) that executes the 'whoami' command and gathers system information such as hostname, user info, and platform. It then sends this data via HTTP POST to a hardcoded, attacker-controlled Cloudflare Workers endpoint unrelated to the package's purported function. This out-of-band communication pattern is typical of reconnaissance beacons used in dependency confusion or typosquatting attacks. The package is flagged as malicious by multiple sources including Amazon Inspector, GHSA malware advisories, and the OpenSSF Package Analysis project.

Any system with this package installed or executed is considered fully compromised. The attacker gains access to sensitive system identifiers and potentially full control over the host. All secrets and keys stored on the compromised system should be assumed exposed and must be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious artifacts or backdoors introduced by the package.

Remove the 'verify-contract-viem' package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on the compromised hosts from a clean, trusted environment. Conduct a thorough investigation for additional persistence mechanisms or malware that may have been installed. There is no official patch or fix available; remediation relies on removal and credential rotation.