verify-contract-ethers

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36)
The package ships a single bin entry (bin/cli.js) that, when invoked, runs `whoami` and POSTs the package name, username, hostname, and platform to a hardcoded Cloudflare Workers callback at https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9. The bin is registered under the name `fuels-typegen` while the package itself is published as `verify-contract-ethers`, a name/bin mismatch consistent with typosquatting or dependency-confusion against fuels-typegen / verify-contract. The package's declared description openly states its purpose is to POST package name and whoami to an out-of-band callback, and no legitimate functionality is present beyond that beacon.

## Source: ossf-package-analysis (dd92ae4a5555d9abe274ad50e627402e6fcba1b9486f0f565dd2a11920417532)
The OpenSSF Package Analysis project identified 'verify-contract-ethers' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

- The package executes one or more commands associated with malicious behavior.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.