{"id":"MAL-2026-18696","summary":"Malicious code in solidity-map (npm)","details":"solidity-map ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof (MAL-2026-17509) and chai-foundry (MAL-2026-13356) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.","modified":"2026-11-05T05:15:05.862772991Z","published":"2026-10-26T00:00:00Z","database_specific":{"iocs":{"ips":[],"urls":[],"domains":[],"files":[{"paths":["index.js"],"digests":{"sha256":"4e6c4e61a7019ab0affe9c2d20e36701b330ec357be205930355bac1464f9316"}},{"digests":{"sha256":"7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb"},"paths":["lib/config.js"]}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solidity-map"},{"type":"WEB","url":"https://osv.dev/vulnerability/MAL-2026-17509"}],"affected":[{"package":{"name":"solidity-map","ecosystem":"npm","purl":"pkg:npm/solidity-map"},"versions":["2.21.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solidity-map/MAL-2026-18696.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}