Malicious code in hardhat-base (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950) Package presents itself as a pino-compatible logger (module.exports.pino = middleware; keywords fast/logger/stream/json) but ships an RCE loader. index.js spawns lib/caller.js as a detached child process on middleware invocation. caller.js reads a base64-encoded URL from a fake process.env-shaped constant (DEV_API_KEY), decodes it via atob to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5, POSTs to that endpoint via axios, and passes the response body to new Function.constructor("require", s) — invoking the returned handler with the real require function. Any consumer that requires this package and calls the exported middleware fetches and executes arbitrary attacker-controlled JavaScript with full Node.js require access. The base64 concealment of the endpoint inside fake env-var constants, the detached child spawn, the cover-story pino API surface, and the mismatch with the manifest description (vulnerability-management text) confirm intentional supply-chain attack rather than an insecure update mechanism.

Source published

21 Sep 2026 16:41:31 UTC

Source modified

21 Sep 2026 16:45:05 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.