fuels-versions@1.0.0

Analysis

The package's bin script (bin/cli.js, exposed as generate-schema-ethers) runs when invoked via npx and acts as a host-metadata beacon. It collects the local username (via whoami with a fallback to os.userInfo()), the machine hostname, and the OS platform, then POSTs them as JSON to the out-of-band callback endpoint hxxps://oobme[.]kunalsharma0553[.]workers[.]dev/r/7bq6fz3l15r9 (a Cloudflare Workers URL), also sending the package name in the X-Package-Name header and request body. The package description openly states it "POSTs package name and whoami to an OOB callback."