{"id":"MAL-2026-14220","summary":"Malicious code in solidity-hold (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f)\nThe npm package solidity-hold@2.0.1 impersonates the popular pino logger: the README badges and lib/ source tree are copied from pino (pinojs/pino), but lib/config.js is replaced with a ~4 MB obfuscator.io-obfuscated bundle (hex string-array, rotating while(!![]) decoder IIFE, control-flow flattening, ~23,890-entry string array). index.js requires('./lib/config') at top level, so this opaque payload executes on any require('solidity-hold'). The advertised middleware export is a no-op stub, and the package declares an axios dependency (network egress capability) that a logger does not need. Publisher metadata (author Jackson Blau \u003chello@jsonspack.com\u003e, bugs URL jsonspack.com/issues) is unrelated to the pino project whose code and branding are copied. Heavy control-flow obfuscation of an auto-executing module inside a package that impersonates a widely used dependency is a payload-carrier shape hostile to any installer that requires the module.\n","modified":"2026-08-19T03:30:19.959083883Z","published":"2026-08-19T03:03:18Z","database_specific":{"malicious-packages-origins":[{"versions":["2.0.1"],"id":"IN-MAL-2026-018320","import_time":"2026-08-19T03:24:21.741324417Z","modified_time":"2026-08-19T03:03:18Z","sha256":"39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solidity-hold/v/2.0.1"}],"affected":[{"package":{"name":"solidity-hold","ecosystem":"npm","purl":"pkg:npm/solidity-hold"},"versions":["2.0.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"solidity-hold-2.0.1.tgz","hashes":{"sha1":"6d0b2689a855b4638bcab926032d3be7e2550614","sha512_sri":"sha512-ioOg6NmliJw4DsZ/TRicB+oPp+5nPIVaNTUfmzz0qma4YCPoJhwXnYMmUelFIrnikXfwXPCOAJQKGdBrnE9RhA=="}}],"evidence_files":[{"path":"lib/config.js","sha256":"1176d4dea79d83166810bfe267ee4e31daa9c1b6d31c351c126bca6b1afb6a61","tlsh":"d91685889245c523d2cc13a3be557aa9f13aa96584ccb607edf9bd6cb4bc807c0b5dd0"},{"path":"README.md","sha256":"6bc462e6cb74540d67c9f92b21b46eeca394d8989289faffc3ee4dac407b5379","tlsh":"7c41666787e46b794b6301b192c275a5ff6fa31c3b5e60a5dcac8129131c592813124e"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solidity-hold/MAL-2026-14220.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}