{"id":"MAL-2026-16349","summary":"Malicious code in hardhat-devkit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95)\nPackage published as `hardhat-devkit` presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README, index.d.ts, and keywords (`fast`, `logger`, `stream`, `json`) are copied from `pinojs/pino`, the manifest description references vulnerability management, and the homepage points at `jsonspack.com` (author `hello@jsonspack.com`). The package's `index.js` unconditionally executes `require('./lib/config')` on load. `lib/config.js` is a single-line ~4,070,107-byte JavaScript file heavily obfuscated with obfuscator.io techniques: hex-escaped identifiers and property names (`_0xNNNN`, `\\x63\\x68\\x61\\x72\\x43\\x6f\\x64\\x65\\x41\\x74`), a self-mutating string-array indexer with an embedded RC4+base64 string decoder (`J[v]=J[W]; e+=String.fromCharCode(N.charCodeAt(a)^J[(J[v]+J[W])%256])`), control-flow flattening via a `while(!![]){try{...}catch{}}` dispatcher, and a debugger-defense self-check. This concealed payload runs on any `require('hardhat-devkit')` or `import` of the package, targeting an audience (Ethereum developers) whose machines are likely to hold wallet keystores, mnemonics, and deployment keys. The combination of brand impersonation, mismatched cover-story metadata copied from an unrelated legitimate project, and a multi-megabyte obfuscated blob reachable at module load time is the supply-chain dropper shape.\n","modified":"2026-09-21T16:45:05.185960235Z","published":"2026-09-21T16:41:23Z","database_specific":{"malicious-packages-origins":[{"sha256":"ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95","source":"amazon-inspector","versions":["2.3.6"],"id":"IN-MAL-2026-020257","import_time":"2026-09-21T16:41:52.089560369Z","modified_time":"2026-09-21T16:41:23Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-devkit/v/2.3.6"}],"affected":[{"package":{"name":"hardhat-devkit","ecosystem":"npm","purl":"pkg:npm/hardhat-devkit"},"versions":["2.3.6"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c","tlsh":"e81674cc6688e423c1cc2b93be0539abf17a686294c8a167df557d5db8bc40bc1a4fd4","path":"lib/config.js"},{"path":"package.json","sha256":"6d29335cf7eb59d754d86f4caa71e4cb4133857171ea2351b155ecfd0c4915b8","tlsh":"75017b20de788e2301fd25425c2a06037a618c175528fc2932db612d0f9d5fb05bf21d"}],"package_integrity":[{"hashes":{"sha1":"2ad2dc5aa631eb362063724484da419d6fefb6ef","sha512_sri":"sha512-FT8YLCj92sQ26GBprwpREGYQ/Lzy2HTcJxQVxy5a8btRv5YiIKtJc/3WtPOXPTN/0bLGNzjezDeH2gj1nvQN8g=="},"filename":"hardhat-devkit-2.3.6.tgz"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-devkit/MAL-2026-16349.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}