{"id":"MAL-2026-17659","revision":"6bb8f4e2a6a645c29f6c7a71cee6d96d","records":[{"revision":"6bb8f4e2a6a645c29f6c7a71cee6d96d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17659","aliases":[],"title":"Malicious code in hardhat-deep (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304)\nThe npm package hardhat-deep@2.0.1 is a trojanised shell. Its tarball copies the pino logger source tree (README, SECURITY.md, index.d.ts, lib/proto.js, lib/transport.js, lib/worker.js, lib/levels.js, lib/multistream.js, etc.) verbatim, while the package name and manifest description target the Hardhat ecosystem. The only novel file is lib/config.js, a single-line 4,499,968-byte obfuscator.io bundle with a 26,234-entry rotated string array, two decoder functions, hex-encoded strings and control-flow flattening. The package's top-level index.js is modified from pino's original to unconditionally `require('./lib/config')`, so any consumer that `require`s or `import`s hardhat-deep executes this opaque payload inside the installer's Node process. The exported middleware is a no-op cover with no logger functionality, so running the obfuscated blob is the only effect of installing or loading the package. The author identity (Robert King <hello@jsonspack.com>, jsonspack.com) is unrelated to either Hardhat or pinojs.\n","state":0,"publishedAt":"2026-10-08T03:43:45+00:00","modifiedAt":"2026-10-08T04:00:05.1431584+00:00","affected":[{"ecosystem":"npm","name":"hardhat-deep","ranges":[],"versions":["2.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/hardhat-deep/v/2.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17659","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17659","identifiers":["MAL-2026-17659"]},"retained":false,"historicalAffected":[]}],"coverage":[]}