MAL-2026-16348

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-base/MAL-2026-16348.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16348
Published
2026-09-21T16:41:31Z
Modified
2026-09-21T16:45:05Z
Summary
Malicious code in hardhat-base (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950)

Package presents itself as a pino-compatible logger (module.exports.pino = middleware; keywords fast/logger/stream/json) but ships an RCE loader. index.js spawns lib/caller.js as a detached child process on middleware invocation. caller.js reads a base64-encoded URL from a fake process.env-shaped constant (DEV_API_KEY), decodes it via atob to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5, POSTs to that endpoint via axios, and passes the response body to new Function.constructor("require", s) — invoking the returned handler with the real require function. Any consumer that requires this package and calls the exported middleware fetches and executes arbitrary attacker-controlled JavaScript with full Node.js require access. The base64 concealment of the endpoint inside fake env-var constants, the detached child spawn, the cover-story pino API surface, and the mismatch with the manifest description (vulnerability-management text) confirm intentional supply-chain attack rather than an insecure update mechanism.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020258",
            "import_time":  "2026-09-21T16:41:52.135709662Z",
            "modified_time":  "2026-09-21T16:41:31Z",
            "sha256":  "a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950",
            "source":  "amazon-inspector",
            "versions":  [
                "2.2.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-020259",
            "import_time":  "2026-09-21T16:41:52.18222329Z",
            "modified_time":  "2026-09-21T16:41:39Z",
            "sha256":  "bcf412ff9e25a300b1f5efafc3c0a2b3c2eaf3abdbe3bba09d9c7b7b21149b26",
            "source":  "amazon-inspector",
            "versions":  [
                "2.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / hardhat-base

Package

Name
hardhat-base
View open source insights on deps.dev
Purl
pkg:npm/hardhat-base

Affected ranges

Affected versions

2.*
2.2.0
2.2.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/caller.js",
            "sha256":  "f9f1f0df98c19421d08ee1ff4b26abe3f90ffd1e978560bfb55033e4f3aa1b18",
            "tlsh":  "8e01bd8d60fd101c016112e5271f94325450e867394ad5d4374c93424fae6be6aa3bef"
        },
        {
            "path":  "package.json",
            "sha256":  "4afebec15615bf48f687f274b07b562067b02548ac790c75d36039e95ceaff0f",
            "tlsh":  "99019c20ce789e2304ed25824c2a064376619c175928fc2933db612c0f9d4ff11bf21e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "hardhat-base-2.2.2.tgz",
            "hashes":  {
                "sha1":  "68beb3c8e9a4cb2416f28accf3709472e3aec549",
                "sha512_sri":  "sha512-E+ft8bsroDlkePtZCvo7aGI5f3AfXDV3uNHuNi/jES+c+HBZI5Llw1nyjUEg0EW5HN1B05TqzKg940eLufZyjA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-base/MAL-2026-16348.json"