Malicious code in hardhat-option (npm)

[email protected] was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like [email protected] (published the day before), the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger (README badges still point to pino) with one file added that pino does not contain: lib/config.js, a 4,499,968-byte obfuscated script. index.js requires ./lib/config on line 6, so the payload runs as soon as the package is required. package.json carries the same fake author as hardhat-promised (Robert King <[email protected]>), no repository, and the added dependency axios. Behavior observed when lib/config.js is loaded in an instrumented sandbox: axios.post of JSON to http://167.88.172.33:8087/api/log containing os.hostname(), os.platform()/release()/type() and os.userInfo().username, with a fixed key ukey=309 (hardhat-promised uses 301), a tag t=3, a timestamp and a SHA-256 'validation' header. The messages posted are 'Failed to spawn autoUploadScript', 'Failed to spawn ldbScript' and 'Failed to spawn socketScript', which name the same three stealer modules as hardhat-promised: automatic file upload, LevelDB (browser extension / wallet storage) reading, and a persistent socket connection to the operator. Trigger: on import (require). Type: trojanized copy of a popular library acting as an information-stealer loader with a hard-coded C2 at 167.88.172.33:8087; second package of the hardhat-promised family. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2d460f6c739361d793fbc66b2aa32d1d9ab6fe0df4caefe13c590f40d05d5277) The package's declared main index.js immediately requires./lib/config, which is a single-line ~4.5MB obfuscator.io-style bundle (26,234-entry hex-escaped string array, rotated decoder wrappers, control-flow flattening) whose top-level IIFE executes as soon as the module is loaded. The exported middleware is a no-op, so the sole effect of require('hardhat-option') is to run the opaque payload with the installer's privileges. The package also presents a false identity: the name is hardhat-option but README, index.d.ts and lib/* are copied from pinojs/pino and index.js re-exports module.exports.pino = middleware to satisfy consumers expecting pino's API, while package.json attributes authorship to 'Robert King <[email protected]>' with an unrelated bugs URL at jsonspack.com. A multi-megabyte, fully obfuscated module body that auto-executes on import inside a package falsely wrapped in another project's identity is the canonical loader/dropper shape.

Source published

8 Oct 2026 03:38:47 UTC

Source modified

12 Oct 2026 05:00:07 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.