verify-contract-viem@1.0.0

Summary

bin/cli.js executes whoami and reads os.hostname() / os.userInfo() / os.platform(), then POSTs those values to the hardcoded endpoint https://oobme.kunalsharma0553.workers.dev/r/7bq6fz3l15r9. The destination is an author-controlled Cloudflare Workers URL unrelated to any legitimate contract-verification purpose implied by the package name. The behavior fires when the CLI is invoked (e.g. via npx verify-contract-viem), transmitting installer host identifiers to a third party with no consent, disclosure, or opt-out. The shape matches an out-of-band reconnaissance beacon commonly used in dependency-confusion / typosquat campaigns.

Source: amazon-inspector (d1037ebeeb5eff8da3b46c8275a09151604157ddc24db244d76d27d97bfdddad)