MAL-2026-17661

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-pack/MAL-2026-17661.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17661
Published
2026-10-08T03:43:57Z
Modified
2026-10-08T04:00:04Z
Summary
Malicious code in hardhat-pack (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02)

The package is published as hardhat-pack, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript declarations and library source are copied verbatim from the unrelated pino logger. The only material divergence from upstream pino is that index.js adds const config = require('./lib/config'); at the top level, and lib/config.js is a single-line 4.4MB obfuscator.io payload: an IIFE with a ~26,000-entry hex-escaped string array and a rotating decoder. Nothing in the shipped source references config for a legitimate purpose, and the package carries no native build, no vendored SDK, and no other justification for a multi-megabyte opaque blob. The package also declares axios as a runtime dependency, consistent with network exfiltration or remote fetch from inside the decoded payload. Any process that imports hardhat-pack hands the opaque payload to the JavaScript engine on first require.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021133",
            "import_time": "2026-10-08T03:50:30.086107934Z",
            "modified_time": "2026-10-08T03:43:57Z",
            "sha256": "b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02",
            "source": "amazon-inspector",
            "versions": [
                "2.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / hardhat-pack

Package

Name
hardhat-pack
View open source insights on deps.dev
Purl
pkg:npm/hardhat-pack

Affected ranges

Affected versions

2.*
2.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/config.js",
            "sha256": "b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c",
            "tlsh": "61265f889244e03796cf1ac3bf0529ede57aa861e4cca30797d4be5cb9ac40bd4b5dd0"
        },
        {
            "path": "package.json",
            "sha256": "947d477618759a0bcd5a4426c5e91751f1bd3d5c5363326cde99b35009a88248",
            "tlsh": "c5017620deb88e2305ed25424c2a0603b6a58c175528fc2933dba12c4fad5ff41bf22d"
        }
    ],
    "package_integrity": [
        {
            "filename": "hardhat-pack-2.0.1.tgz",
            "hashes": {
                "sha1": "9d0bbc030f64f09a98e4c425f5f248689e8eb217",
                "sha512_sri": "sha512-jnJmr5Rg99If4NpjXqZ0+ZBO34HdD+8lpneBnmNLZUZgvoN4POqjOgkVuW5acnUofdyeDQIJrarNMYuIEpMyHA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-pack/MAL-2026-17661.json"