GCVE-110-OSM-2026-11550

The package contains an explicit OOB exfiltration beacon hardcoded in bin/cli.js: it executes `whoami`, collects hostname and platform, then POSTs this system fingerprint to a Cloudflare Worker acting as an out-of-band callback collector. The package description even self-describes as 'Minimal npx package that POSTs package name and whoami to an OOB callback', leaving no ambiguity about intent. The publisher `6ughunt3r9` has a malicious ratio of 0.80 (8 of 10 checked packages already reported malicious in OSM), with this account created only 2 days before publication — a classic throwaway identity used for dependency confusion or typosquatting campaigns targeting the FuelVM/Web3 ecosystem (fuels-core, fuels-typegen, fuels-forc, fuels-versions). The attacker model is dependency confusion / typosquatting: lure developers in the Fuel Network or Web3 tooling ecosystem into running these npx packages, beacon the victim's username, hostname, and platform to an attacker-controlled endpoint for initial access reconnaissance. ENTRY bin/cli.js (bin: bin/cli.js) EXFIL - System Information Exfiltration in bin/cli.js: "os.userInfo().username; } catch { return "unknown"; } } } async function main() ..." - System Information Collection in bin/cli.js: "os.userInfo()" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Platform Detection with Data Collection in bin/cli.js: "JSON.stringify({ pkg: name, whoami: user, hostname: os.hostname(), platform: os...." - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES bin/cli.js