@coveops/abi shipped Qix wallet drainer

@coveops/abi was a follow-on package in the September 2025 npm phishing wave. JFrog identified version 2.0.1 as malicious after the first public attention had centered on the better-known Qix-maintained utility packages.

The package was not part of the original maintainer account set, which is why it is modeled separately. The trust boundary was still npm's official distribution path: a developer or build system resolving @coveops/abi to 2.0.1 received attacker-supplied JavaScript under the legitimate package name.

The payload family was aimed at browser-side cryptocurrency theft. Public advisories describe code that watched web3 transaction activity and attempted to redirect payments to attacker-controlled addresses. That made the package dangerous when bundled into front-end code or applications that touched wallet flows.

This record preserves the CoveOps package coordinate, hash, and one-day exposure window. The parent [[qix-npm-phishing-2025]] record carries the phishing path, shared wallet-drainer behavior, and larger npm campaign context.