viem-ethereum@2.47.9

Analysis

viem-ethereum is a combosquat (trojanized clone) of the legitimate viem Ethereum library. When imported, the privateKeyToAccount() function silently exfiltrates the user's Ethereum private key via the MailerSend email API. The exfiltration payload is injected as eval(decodeURIComponent(atob(...))) in accounts/privateKeyToAccount.ts and its compiled outputs (_cjs/ and _esm/). The stolen private key is emailed to [account] and [account] with subject line "Private Key", sent from [account] using a hardcoded MailerSend API key. The package adds mailersend as a declared dependency to support the exfiltration channel. Any developer who installs this package and calls privateKeyToAccount() (a core wallet-creation function) will have their private key compromised.