fuels-forc @1.0.0
Vulnerability report · Last retrieved from osv.dev August 31, 2026 at 11:43 PM UTC
OSV ID
MAL-2026-15626
Ecosystem
npm
Summary
bin/cli.js runs whoami and reads os.hostname() / os.platform(), then POSTs the package name together with those host identifiers to the hardcoded endpoint https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9. The destination is non-first-party and not caller-configurable, and the beacon fires unconditionally on execution. The package name resembles the legitimate Fuel Labs forc toolchain, consistent with a dependency-confusion / typosquat recon lure.
Source: amazon-inspector (b993583bec4136d0b060dc6391c10e15f836e605b5b13b97dea6bb7a3dc1e5cd)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.