@paoletti/viem@2.53.1

Analysis

@paoletti/viem@2.53.1 is a trojanized clone of the legitimate viem Ethereum library. The package replaces the critical cryptographic dependency `@noble/hashes` (used for keccak256, sha256, and ripemd160 hashing in all Ethereum signing and wallet operations) with `@paoletti/hashes` via the npm alias `"@noble/hashes": "npm:@paoletti/hashes@1.8.0"`. When any code imports hashing functions from `@noble/hashes`, npm resolves this to the attacker-controlled `@paoletti/hashes` instead, giving the attacker control over cryptographic operations underpinning wallet signing, transaction construction, and address derivation. The package is published by user "paoletti" ([account]) and has no install scripts — the attack is the dependency substitution itself.