{"id":"MAL-2026-17661","revision":"7869e628991647eaaedd004aa5d5be49","records":[{"revision":"7869e628991647eaaedd004aa5d5be49","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17661","aliases":[],"title":"Malicious code in hardhat-pack (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02)\nThe package is published as `hardhat-pack`, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript declarations and library source are copied verbatim from the unrelated `pino` logger. The only material divergence from upstream pino is that `index.js` adds `const config = require('./lib/config');` at the top level, and `lib/config.js` is a single-line 4.4MB obfuscator.io payload: an IIFE with a ~26,000-entry hex-escaped string array and a rotating decoder. Nothing in the shipped source references `config` for a legitimate purpose, and the package carries no native build, no vendored SDK, and no other justification for a multi-megabyte opaque blob. The package also declares `axios` as a runtime dependency, consistent with network exfiltration or remote fetch from inside the decoded payload. Any process that imports `hardhat-pack` hands the opaque payload to the JavaScript engine on first require.\n","state":0,"publishedAt":"2026-10-08T03:43:57+00:00","modifiedAt":"2026-10-08T04:00:04.2231223+00:00","affected":[{"ecosystem":"npm","name":"hardhat-pack","ranges":[],"versions":["2.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/hardhat-pack/v/2.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17661","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17661","identifiers":["MAL-2026-17661"]},"retained":false,"historicalAffected":[]}],"coverage":[]}