Malicious code in hardhat-cap (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8) The package is published as `hardhat-cap` but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger, with author metadata pointing at jsonspack.com. index.js unconditionally does `const config = require('./lib/config');`, and lib/config.js is a ~4 MB single-line obfuscator.io-transformed module (rotated string array of ~23,931 entries, dual decoders, RC4+base64 string decoding, control-flow flattening) whose top-level IIFE self-invokes at load time. Requiring the package executes this opaque payload on the installer's host at import time; the surrounding pino code is unrelated cover. A logger has no need for a multi-megabyte obfuscated self-decoding blob, and the name/contents mismatch (Hardhat-themed name, pino source, obfuscated third module) is consistent with a typosquat lure that drops arbitrary code execution into consumers on `require`. ## Source: ghsa-malware (ccce44942655178e47726747129cc46b08ececfec2b88cedbbc258f1d5edb54f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the p
MAL-2026-13616
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-13616
hardhat-cap
Source reference: /affected/0/package/name
- Affected versions
- 2.21.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "hardhat-cap",
"purl": "pkg:npm/hardhat-cap",
"ecosystem": "npm"
},
"versions": [
"2.21.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-cap/MAL-2026-13616.json",
"indicators": {
"evidence_files": [
{
"path": "lib/config.js",
"tlsh": "ab1674488181f02393cd5b63bf457aecfc7a68a694cc654b8559bd2de8bc40bd9e2cc4",
"sha256": "c9b83cdf9b6c915f02485cce0d993653a07cb78d12317904270f808e65529c30"
},
{
"path": "package.json",
"tlsh": "75017620deb88e2301ed25424c2a0643b6618c175528fc2933dba12c0fad5fb41ff22e",
"sha256": "b368dc0c975566bf937ccfb42399ffd527e264938667ffeb9d8650a23f9f0e5f"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "ef146a433a457ff4dac5728945c83dd5974a7705",
"sha512_sri": "sha512-HdE46WfA9sGKDSD1vjxIVLJOhVeHpLwC2VketanM9TjPN5dAW8ATNiOpYvVVV+uLPven2MXUsIGW3Fwfy5xIjQ=="
},
"filename": "hardhat-cap-2.21.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #22652 · Revision 1
- Added to Heist Feed
- Publisher date