@lexborn/viem@2.53.2

Analysis

@lexborn/viem is a trojanized clone of the legitimate viem Ethereum library. The package replicates the real viem's source code and metadata (pointing to the official wevm/viem repository) but is published by an unrelated attacker. The package substitutes the 'isows' WebSocket dependency with the attacker-controlled @lexborn/isows package. When a developer uses this package's WebSocket transport (createPublicClient or createWalletClient with webSocket() transport), all Ethereum RPC WebSocket connections are routed through the attacker's package, which can intercept, modify, or exfiltrate transaction data, wallet interactions, and private keys. No install script is used — the attack activates at runtime when the WebSocket transport is imported. Affected dependency: @lexborn/isows@1.0.7 replaces the legitimate isows package.