The @wrenfield/abitype package is a malicious impersonation of the well-known wevm/abitype library. It copies legitimate documentation and metadata to appear authentic but includes an obfuscated payload in two import-reachable files. This payload uses RC4-decoded strings, control-flow flattening, and anti-debugging techniques to dynamically load Node.js http/https modules, fetch a remote payload via HTTP GET with custom User-Agent headers, follow redirects, write the payload to disk with executable permissions, and execute it detached from the parent process. Because the malicious code is reachable through the package's main entry and marked as sideEffects in package.json, it triggers automatically upon import or require, resulting in arbitrary code execution on the host system.

Installing or importing the affected versions (1.2.6 and 1.2.7) of @wrenfield/abitype results in execution of attacker-controlled code on the victim's machine. This can lead to full system compromise, unauthorized code execution, and potential persistence. The malicious payload downloads and runs arbitrary binaries, which can evade detection and operate detached from the parent process.

No official patch or fix is currently available for this malicious package. Users should immediately avoid installing or importing @wrenfield/abitype versions 1.2.6 and 1.2.7. Remove these versions if already installed. Prefer using the legitimate wevm/abitype package from trusted sources. Monitor package dependencies carefully to detect and block impersonation or typosquatting attacks. Check vendor advisories or trusted security sources for updates or remediation guidance.