The npm package @wrenfield/abitype impersonates the legitimate wevm/abitype library by copying its README and repository metadata. It contains obfuscated malicious code that executes automatically when the package is imported or required. This code downloads and executes attacker-controlled payloads on the victim's machine, posing a severe security risk. Versions 1.2.6 and 1.2.7 of @wrenfield/abitype are affected.