MalwarePublished 14 Jul 2026Updated 5 Aug 2026

@wrenfield/abitype (npm) · Malicious Code

Affects @wrenfield/abitypeSource GCVE Database

Malicious package : remove @wrenfield/abitype and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10529

What to do

Remove @wrenfield/abitype from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@wrenfield/abitype	Affected 1.2.3 – 1.2.7 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @wrenfield/abitype impersonates the legitimate wevm/abitype library by copying its README and repository metadata. It contains obfuscated malicious code that executes automatically when the package is imported or required. This code downloads and executes attacker-controlled payloads on the victim's machine, posing a severe security risk. Versions 1.2.6 and 1.2.7 of @wrenfield/abitype are affected.

Impact

Installing or importing the affected versions (1.2.6 and 1.2.7) of @wrenfield/abitype results in execution of attacker-controlled code on the victim's machine. This can lead to full system compromise, unauthorized code execution, and potential persistence. The malicious payload downloads and runs arbitrary binaries, which can evade detection and operate detached from the parent process.

Defensive guidance

Users should immediately avoid installing or importing @wrenfield/abitype versions 1.2.6 and 1.2.7. Remove these versions if already installed. Prefer using the legitimate wevm/abitype package from trusted sources. Monitor package dependencies carefully to detect and block impersonation or typosquatting attacks. Check vendor advisories or trusted security sources for updates or remediation guidance.

Summary

The @wrenfield/abitype package is a malicious impersonation of the well-known wevm/abitype library. It copies legitimate documentation and metadata to appear authentic but includes an obfuscated payload in two import-reachable files. This payload uses RC4-decoded strings, control-flow flattening, and anti-debugging techniques to dynamically load Node.js http/https modules, fetch a remote payload via HTTP GET with custom User-Agent headers, follow redirects, write the payload to disk with executable permissions, and execute it detached from the parent process. Because the malicious code is reachable through the package's main entry and marked as sideEffects in package.json, it triggers automatically upon import or require, resulting in arbitrary code execution on the host system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:31 UTC

Technical details

References

Community reviews