@velkov/viem@2.53.1

Analysis

Trojanized clone of the viem Ethereum library published under the @velkov scope. The package is a verbatim copy of the real viem@2.53.1 source code with one modification: the "isows" dependency (a WebSocket wrapper used by viem for all blockchain RPC connections) is aliased to @velkov/isows@1.0.7, a maliciously-controlled substitute. When applications using this package create WebSocket RPC transports (the standard way viem connects to Ethereum nodes), the import of 'isows' resolves to the attacker's code instead of the legitimate package, giving the attacker control over WebSocket connections and the ability to intercept signed transactions, private keys, and wallet communications. No lifecycle hooks are used — the attack activates at runtime on import. Also observed: @paoletti/viem@2.53.1 (same campaign, substituting @noble/hashes instead). Publisher emails use the web-library[.]net domain.