MAL-2026-13609
Dashboard / Malicious Package / MAL-2026-13609
MAL-2026-13609
Summary: Malicious code in hardhat-set (npm)
Details: Source: amazon-inspector (7cf6b9d0ee4a23bfab6e7a3c21f69a36e0655019cf1dd602f93760e233c7f701) The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project (github.com/pinojs/pino), while package.json declares author 'Robert King <[email protected]>' with bugs URL 'https://jsonspack.com/issues'. index.js executes `const config = require('./lib/config')` at load time; lib/config.js is a 4,060,622-byte single-line file packed with obfuscator.io (23,931-entry rotated string array, RC4/base64 string decoder, control-flow flattening, self-defending checks) and runs a top-level IIFE on require. No other file in the package references config's exports, and pino itself contains no such module. The combination of a name/README mismatch (pino cover story on a package named after Hardhat), an unrelated author domain, and a multi-megabyte obfuscated blob that self-executes on import is a masquerade/typosquat delivering a hidden payload to anyone who installs or requires the package.
Affected packages
Package
Name: hardhat-set
Purl: pkg:npm/hardhat-set
Affected ranges
Type: N/A
Events:
