fuels-forc

GHSA-fp66-f7fp-cq8j

Malicious code in fuels-forc (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (b993583bec4136d0b060dc6391c10e15f836e605b5b13b97dea6bb7a3dc1e5cd)
bin/cli.js runs `whoami` and reads os.hostname() / os.platform(), then POSTs the package name together with those host identifiers to the hardcoded endpoint https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9. The destination is non-first-party and not caller-configurable, and the beacon fires unconditionally on execution. The package name resembles the legitimate Fuel Labs `forc` toolchain, consistent with a dependency-confusion / typosquat recon lure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b9c9c442d6f4450955c7f85e197c76604ba12743/osv/malicious/npm/fuels-forc/MAL-2026-15626.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b9c9c442d6f4450955c7f85e197c76604ba12743/osv/malicious/npm/fuels-forc/MAL-2026-15626.json
- https://www.npmjs.com/package/fuels-forc/v/1.0.0
- https://github.com/ossf/malicious-packages/blob/b6d0c2e5e8f80f8f080fcb3b3be7dc62a8627602/osv/malicious/npm/fuels-forc/MAL-2026-15626.json
- https://github.com/advisories/GHSA-fp66-f7fp-cq8j

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.