MAL-2026-14220

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solidity-hold/MAL-2026-14220.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14220
Published
2026-08-19T03:03:18Z
Modified
2026-08-19T03:30:19.959083883Z
Summary
Malicious code in solidity-hold (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f)

The npm package solidity-hold@2.0.1 impersonates the popular pino logger: the README badges and lib/ source tree are copied from pino (pinojs/pino), but lib/config.js is replaced with a ~4 MB obfuscator.io-obfuscated bundle (hex string-array, rotating while(!![]) decoder IIFE, control-flow flattening, ~23,890-entry string array). index.js requires('./lib/config') at top level, so this opaque payload executes on any require('solidity-hold'). The advertised middleware export is a no-op stub, and the package declares an axios dependency (network egress capability) that a logger does not need. Publisher metadata (author Jackson Blau hello@jsonspack.com, bugs URL jsonspack.com/issues) is unrelated to the pino project whose code and branding are copied. Heavy control-flow obfuscation of an auto-executing module inside a package that impersonates a widely used dependency is a payload-carrier shape hostile to any installer that requires the module.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T03:24:21.741324417Z",
            "sha256": "39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f",
            "modified_time": "2026-08-19T03:03:18Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018320",
            "versions": [
                "2.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / solidity-hold

Package

Name
solidity-hold
View open source insights on deps.dev
Purl
pkg:npm/solidity-hold

Affected ranges

Affected versions

2.*
2.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solidity-hold/MAL-2026-14220.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "1176d4dea79d83166810bfe267ee4e31daa9c1b6d31c351c126bca6b1afb6a61",
            "tlsh": "d91685889245c523d2cc13a3be557aa9f13aa96584ccb607edf9bd6cb4bc807c0b5dd0",
            "path": "lib/config.js"
        },
        {
            "sha256": "6bc462e6cb74540d67c9f92b21b46eeca394d8989289faffc3ee4dac407b5379",
            "path": "README.md",
            "tlsh": "7c41666787e46b794b6301b192c275a5ff6fa31c3b5e60a5dcac8129131c592813124e"
        }
    ],
    "package_integrity": [
        {
            "filename": "solidity-hold-2.0.1.tgz",
            "hashes": {
                "sha1": "6d0b2689a855b4638bcab926032d3be7e2550614",
                "sha512_sri": "sha512-ioOg6NmliJw4DsZ/TRicB+oPp+5nPIVaNTUfmzz0qma4YCPoJhwXnYMmUelFIrnikXfwXPCOAJQKGdBrnE9RhA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]