MalwarePublished 14 Jul 2026Updated 5 Aug 2026

@wrenfield/viem (npm) · Malicious Code

Affects @wrenfield/viemSource GCVE Database

Malicious package : remove @wrenfield/viem and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10571

What to do

Remove @wrenfield/viem from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@wrenfield/viem	Affected 2.53.1 – 2.53.4 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fa26048a977a00adcd1ffc42ccf06110e3807bb2a3145a01fd01318dcfe79771) Package `@wrenfield/viem` impersonates the popular `viem` library (homepage viem.sh, repo wevm/viem); README and authors fields credit the real viem maintainers but the package itself is published under an unrelated `@wrenfield` scope. The shipped source under `_cjs/` mirrors viem's real code, but `package.json` rewrites the `abitype` dependency via npm alias: `"abitype": "npm:@wrenfield/abitype@1.2.4"`. The CommonJS entry `_cjs/index.js` calls `require("abitype")` at module load, so any installer who `require()`s or `import`s `@wrenfield/viem` transitively pulls and executes code from `@wrenfield/abitype@1.2.4` — a separate package under the same attacker-controlled scope, outside this tarball. The combination of brand impersonation of a top npm package plus a silent dependency redirect to an attacker-controlled namespace is the namespace-abuse / dependency-hijack pattern: the lure package looks legitimate on inspection, while the actual payload is delivered through the redirected dependency at first import.

Impact

Users who install and import or require @wrenfield/viem@2.53.4 will unknowingly execute malicious code from the attacker-controlled @wrenfield/abitype package. This can lead to arbitrary code execution within the context of the importing application, potentially compromising the system or data depending on the environment where the package is used.

Defensive guidance

Users should avoid installing or using the @wrenfield/viem package, especially version 2.53.4. Verify package provenance carefully and prefer the official viem package from the legitimate maintainers. Monitor vendor advisories for updates or official remediation guidance.

Summary

The malicious package @wrenfield/viem mimics the popular viem library's code and metadata but is published under the @wrenfield scope, which is unrelated to the original maintainers. Its package.json uses an npm alias to redirect the abitype dependency to @wrenfield/abitype@1.2.4, an attacker-controlled package outside the main tarball. When the CommonJS entry point is loaded, it requires this aliased abitype package, causing execution of attacker-controlled code. This technique combines brand impersonation with dependency hijacking to deliver malicious code stealthily upon import or require.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:25 UTC

Technical details

References

Community reviews