The @wizloft/harness-validation npm package version 0.1.1-alpha.3 includes obfuscated code appended to its compiled validation logic. This code, not declared in type definitions, runs immediately when the package is imported. It contacts Ethereum blockchain explorers using hardcoded RPC endpoints and an attacker Ethereum address to retrieve transaction data. From this data, it extracts a URL pointing to additional payloads, which it downloads and executes dynamically. This design allows the attacker to rotate the malicious code by posting new transactions from the attacker-controlled wallet, effectively maintaining a persistent remote code execution backdoor in any environment importing the package. Sibling packages @wizloft/harness-evidence and @wizloft/harness-kernel at matching alpha versions also contain similar trojanized code.

Any environment importing @wizloft/harness-validation version 0.1.1-alpha.3 is subject to remote code execution controlled by an attacker. The attacker can dynamically update the malicious payload by posting new Ethereum transactions, enabling persistent and stealthy compromise. This can lead to arbitrary code execution, data exfiltration, or further system compromise. The presence of sibling trojanized packages increases the risk of wider infection within projects using the @wizloft namespace.

No official patch or remediation guidance is provided in the available data. Users should immediately remove and avoid using @wizloft/harness-validation version 0.1.1-alpha.3 and related @wizloft packages at matching alpha versions. Audit dependencies for these packages and replace them with trusted alternatives. Monitor for any updates from the package maintainers or npm advisories for official fixes or removals. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.