{"id":"MAL-2026-17660","revision":"bac890d142934cef847c14a4a093fc7a","records":[{"revision":"bac890d142934cef847c14a4a093fc7a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17660","aliases":[],"title":"Malicious code in hardhat-option (npm)","description":"hardhat-option@2.0.1 was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like hardhat-promised@2.21.0 (published the day before), the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger (README badges still point to pino) with one file added that pino does not contain: lib/config.js, a 4,499,968-byte obfuscated script. index.js requires ./lib/config on line 6, so the payload runs as soon as the package is required. package.json carries the same fake author as hardhat-promised (Robert King <hello@jsonspack.com>), no repository, and the added dependency axios.\n\nBehavior observed when lib/config.js is loaded in an instrumented sandbox: axios.post of JSON to http://167.88.172.33:8087/api/log containing os.hostname(), os.platform()/release()/type() and os.userInfo().username, with a fixed key ukey=309 (hardhat-promised uses 301), a tag t=3, a timestamp and a SHA-256 'validation' header. The messages posted are 'Failed to spawn autoUploadScript', 'Failed to spawn ldbScript' and 'Failed to spawn socketScript', which name the same three stealer modules as hardhat-promised: automatic file upload, LevelDB (browser extension / wallet storage) reading, and a persistent socket connection to the operator.\n\nTrigger: on import (require). Type: trojanized copy of a popular library acting as an information-stealer loader with a hard-coded C2 at 167.88.172.33:8087; second package of the hardhat-promised family.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d460f6c739361d793fbc66b2aa32d1d9ab6fe0df4caefe13c590f40d05d5277)\nThe package's declared main index.js immediately requires./lib/config, which is a single-line ~4.5MB obfuscator.io-style bundle (26,234-entry hex-escaped string array, rotated decoder wrappers, control-flow flattening) whose top-level IIFE executes as soon as the module is loaded. The exported middleware is a no-op, so the sole effect of require('hardhat-option') is to run the opaque payload with the installer's privileges. The package also presents a false identity: the name is hardhat-option but README, index.d.ts and lib/* are copied from pinojs/pino and index.js re-exports module.exports.pino = middleware to satisfy consumers expecting pino's API, while package.json attributes authorship to 'Robert King <hello@jsonspack.com>' with an unrelated bugs URL at jsonspack.com. A multi-megabyte, fully obfuscated module body that auto-executes on import inside a package falsely wrapped in another project's identity is the canonical loader/dropper shape.\n","state":0,"publishedAt":"2026-10-08T03:38:47+00:00","modifiedAt":"2026-10-12T05:00:07.9731775+00:00","affected":[{"ecosystem":"npm","name":"hardhat-option","ranges":[],"versions":["2.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/hardhat-option/v/2.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17660","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17660","identifiers":["MAL-2026-17660"]},"retained":false,"historicalAffected":[]}],"coverage":[]}