The malicious package @wrenfield/viem mimics the popular viem library's code and metadata but is published under the @wrenfield scope, which is unrelated to the original maintainers. Its package.json uses an npm alias to redirect the abitype dependency to @wrenfield/[email protected], an attacker-controlled package outside the main tarball. When the CommonJS entry point is loaded, it requires this aliased abitype package, causing execution of attacker-controlled code. This technique combines brand impersonation with dependency hijacking to deliver malicious code stealthily upon import or require.

Users who install and import or require @wrenfield/[email protected] will unknowingly execute malicious code from the attacker-controlled @wrenfield/abitype package. This can lead to arbitrary code execution within the context of the importing application, potentially compromising the system or data depending on the environment where the package is used.

No official patch or fix is currently documented. Users should avoid installing or using the @wrenfield/viem package, especially version 2.53.4. Verify package provenance carefully and prefer the official viem package from the legitimate maintainers. Monitor vendor advisories for updates or official remediation guidance.