MAL-2026-13616
Dashboard / Malicious Package / MAL-2026-13616
MAL-2026-13616
Summary: Malicious code in hardhat-cap (npm)
Details: Source: amazon-inspector (f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8) The package is published as `hardhat-cap` but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger, with author metadata pointing at jsonspack.com. index.js unconditionally does `const config = require('./lib/config');`, and lib/config.js is a ~4 MB single-line obfuscator.io-transformed module (rotated string array of ~23,931 entries, dual decoders, RC4+base64 string decoding, control-flow flattening) whose top-level IIFE self-invokes at load time. Requiring the package executes this opaque payload on the installer's host at import time; the surrounding pino code is unrelated cover. A logger has no need for a multi-megabyte obfuscated self-decoding blob, and the name/contents mismatch (Hardhat-themed name, pino source, obfuscated third module) is consistent with a typosquat lure that drops arbitrary code execution into consumers on `require`.
Affected packages
Package
Name: hardhat-cap
Purl: pkg:npm/hardhat-cap
Affected ranges
Type: N/A
Events:
