verify-contract-ethers@1.0.0

Summary

The package ships a single bin entry (bin/cli.js) that, when invoked, runs whoami and POSTs the package name, username, hostname, and platform to a hardcoded Cloudflare Workers callback at https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9. The bin is registered under the name fuels-typegen while the package itself is published as verify-contract-ethers, a name/bin mismatch consistent with typosquatting or dependency-confusion against fuels-typegen / verify-contract. The package's declared description openly states its purpose is to POST package name and whoami to an out-of-band callback, and no legitimate functionality is present beyond that beacon.

Source: amazon-inspector (ec7cfabb396e93e034caeb560ea029e3ca2bde784b8c713d5f8941a2b621dd36)