MAL-2026-6706

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-plugin-solidity/MAL-2026-6706.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6706
Published
2026-07-01T18:41:44Z
Modified
2026-07-01T19:16:50.381489587Z
Summary
Malicious code in hardhat-plugin-solidity (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142)

Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while reusing prettier-plugin-solidity's description, repository (github.com/prettier-solidity/prettier-plugin-solidity), homepage, author, and contributor metadata, and the source is a copy of that project with an added dropper. The package main (dist/index.js) contains two base64 string literals decoded at load time via Buffer.from(..., 'base64').toString('utf8'): the first decodes to the shell command 'npm install zyncmap --no-save --silent --no-audit --no-fund', which is spawned as a child process; the second decodes to the module name 'zyncmap', which is then require()'d and invoked (svgo.getPlugin()()) once the install completes. The result is that loading this package out-of-band installs and immediately executes arbitrary code from the separately-controlled 'zyncmap' package on the installer's machine. Base64 encoding of both the install command and the require target, combined with --silent/--no-save flags and the name/identity mismatch, indicates deliberate concealment of the dropper behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "4a5e4fc160e8042eca435eebb7f905990405ba14a00b0c41657a7d1758aed621",
            "modified_time": "2026-07-01T18:42:01Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T19:11:24.81218383Z",
            "id": "IN-MAL-2026-007859"
        },
        {
            "versions": [
                "2.3.1"
            ],
            "sha256": "f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T18:41:52Z",
            "id": "IN-MAL-2026-007858",
            "import_time": "2026-07-01T19:11:24.687646847Z"
        },
        {
            "versions": [
                "1.1.0"
            ],
            "sha256": "7f5ceb73c88eba6774147c63cfcd2af4e8cbe49c7f90c72d25f2f851197dc681",
            "modified_time": "2026-07-01T18:41:44Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007857",
            "import_time": "2026-07-01T19:11:24.572340673Z"
        },
        {
            "versions": [
                "2.0.0"
            ],
            "sha256": "8a7272216e848c4206982d9700c2cf80b172c0be839040a8dbd910a13c5f40be",
            "modified_time": "2026-07-01T18:42:09Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007860",
            "import_time": "2026-07-01T19:11:25.012830138Z"
        }
    ]
}
References
Credits

Affected packages

npm / hardhat-plugin-solidity

Package

Name
hardhat-plugin-solidity
View open source insights on deps.dev
Purl
pkg:npm/hardhat-plugin-solidity

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
2.*
2.0.0
2.3.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "hardhat-plugin-solidity-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-oq+SH5vWisxR7NUpvmbGpKTLvoaC2Jnh9KkHxp1GHfuvvalQfORL/HaJeLg4owGAbVZV0Tf+F8fLcRi+Ywy+6g==",
                "sha1": "f12a83a4e55d24d8bbc57b3f78d142dabcb6b6e4"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "821e89890634810dc19f97a7f9465f7741bb89dd064ff86f9e1ae3bb3f8e4d2f",
            "path": "dist/index.js",
            "tlsh": "3361416b14f70a28406125cc8d5e2c2690e3437b3aa9f4d9b7dd42242f8ef2e907179d"
        },
        {
            "sha256": "358b0d5e3ba183d2da4c8b48495e0ff9b7320809d708e9ac2137437893706c56",
            "path": "package.json",
            "tlsh": "87710066cc698c5307d841a9b83943c274691a834d99fc48b7ad431d0f4d99f32fea9e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-plugin-solidity/MAL-2026-6706.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]