fuels-core@1.0.0

Summary

The package's bin script (bin/cli.js) collects whoami, os.hostname(), and os.platform() and POSTs them along with the package name to a hardcoded Cloudflare Workers URL (https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9) with no configuration or opt-out. The bin is exposed as generate-schema-viem, and the package name fuels-core resembles the Fuel ecosystem's fuels package, consistent with typosquat/dependency-confusion reconnaissance targeting installers who resolve or invoke this package (e.g., via npx). The package.json description openly states its purpose is to POST package name and whoami to an OOB callback.

Source: amazon-inspector (c632848960231dec103d878a13a714e057a5922edcc0398884b6fd6d621e0971)