MAL-2026-16349

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-devkit/MAL-2026-16349.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16349
Published
2026-09-21T16:41:23Z
Modified
2026-09-21T16:45:05Z
Summary
Malicious code in hardhat-devkit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95)

Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README, index.d.ts, and keywords (fast, logger, stream, json) are copied from pinojs/pino, the manifest description references vulnerability management, and the homepage points at jsonspack.com (author hello@jsonspack.com). The package's index.js unconditionally executes require('./lib/config') on load. lib/config.js is a single-line ~4,070,107-byte JavaScript file heavily obfuscated with obfuscator.io techniques: hex-escaped identifiers and property names (_0xNNNN, \x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74), a self-mutating string-array indexer with an embedded RC4+base64 string decoder (J[v]=J[W]; e+=String.fromCharCode(N.charCodeAt(a)^J[(J[v]+J[W])%256])), control-flow flattening via a while(!![]){try{...}catch{}} dispatcher, and a debugger-defense self-check. This concealed payload runs on any require('hardhat-devkit') or import of the package, targeting an audience (Ethereum developers) whose machines are likely to hold wallet keystores, mnemonics, and deployment keys. The combination of brand impersonation, mismatched cover-story metadata copied from an unrelated legitimate project, and a multi-megabyte obfuscated blob reachable at module load time is the supply-chain dropper shape.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020257",
            "import_time":  "2026-09-21T16:41:52.089560369Z",
            "modified_time":  "2026-09-21T16:41:23Z",
            "sha256":  "ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95",
            "source":  "amazon-inspector",
            "versions":  [
                "2.3.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / hardhat-devkit

Package

Name
hardhat-devkit
View open source insights on deps.dev
Purl
pkg:npm/hardhat-devkit

Affected ranges

Affected versions

2.*
2.3.6

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/config.js",
            "sha256":  "88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c",
            "tlsh":  "e81674cc6688e423c1cc2b93be0539abf17a686294c8a167df557d5db8bc40bc1a4fd4"
        },
        {
            "path":  "package.json",
            "sha256":  "6d29335cf7eb59d754d86f4caa71e4cb4133857171ea2351b155ecfd0c4915b8",
            "tlsh":  "75017b20de788e2301fd25425c2a06037a618c175528fc2932db612d0f9d5fb05bf21d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "hardhat-devkit-2.3.6.tgz",
            "hashes":  {
                "sha1":  "2ad2dc5aa631eb362063724484da419d6fefb6ef",
                "sha512_sri":  "sha512-FT8YLCj92sQ26GBprwpREGYQ/Lzy2HTcJxQVxy5a8btRv5YiIKtJc/3WtPOXPTN/0bLGNzjezDeH2gj1nvQN8g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-devkit/MAL-2026-16349.json"