{"id":"MAL-2026-17507","summary":"Malicious code in hardhat-jsx (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1)\nThe package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger (keywords 'fast','logger','stream','json'; shipped docs reference pinojs/pino). The main entry index.js unconditionally requires./lib/config, which is a 4,499,968-byte single-line obfuscator.io artifact — a hex-escaped string array of ~26,234 entries with string-array rotation and control-flow flattening (22,707 decoder-wrapper inlines, 44,499 string-inline changes). A legitimate pino 'config' module is ~1-2KB; a multi-megabyte obfuscated blob auto-loaded by the main entry is a loader/dropper. The surface index.js exports a no-op Express-style middleware whose comment claims it 'triggers a background process', providing a cover story adjacent to the obfuscated require. Loading the package via require/import executes the opaque payload in the installer's process. The name/content mismatch (hardhat-jsx vs. pino impersonation), the stub façade, and the heavily obfuscated auto-loaded module together form a trojan-package shape.\n","modified":"2026-10-04T23:45:20.308019626Z","published":"2026-10-04T23:28:05Z","database_specific":{"malicious-packages-origins":[{"sha256":"62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1","source":"amazon-inspector","versions":["2.0.1"],"id":"IN-MAL-2026-020971","import_time":"2026-10-04T23:40:47.128073047Z","modified_time":"2026-10-04T23:28:05Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-jsx/v/2.0.1"}],"affected":[{"package":{"name":"hardhat-jsx","ecosystem":"npm","purl":"pkg:npm/hardhat-jsx"},"versions":["2.0.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-jsx/MAL-2026-17507.json","indicators":{"evidence_files":[{"sha256":"b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c","tlsh":"61265f889244e03796cf1ac3bf0529ede57aa861e4cca30797d4be5cb9ac40bd4b5dd0","path":"lib/config.js"},{"tlsh":"85017620deb88e2305ed25424c2a0603b6a58c175528fc2933dba12c0fad5fb41bf22e","path":"package.json","sha256":"33a629df960cc3d188fe59c447f0a0e513f60ccfd076e3983e5de7f146ac657b"}],"package_integrity":[{"filename":"hardhat-jsx-2.0.1.tgz","hashes":{"sha1":"4ab772462eddc1c7ee8a457b784a42832668bb45","sha512_sri":"sha512-fYiJRq59JqLLeRKMwlg5wU3vRNoyj6v4F1spmFsXQ9K930JvqF21ZHSmbGyiKJ2pBgKXVrDzmrpEyiHX4mRCGA=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}