MAL-2026-14220

    Dashboard / Malicious Package / MAL-2026-14220

    MAL-2026-14220

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in solidity-hold (npm)

    Details: Source: amazon-inspector (39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f) The npm package [email protected] impersonates the popular pino logger: the README badges and lib/ source tree are copied from pino (pinojs/pino), but lib/config.js is replaced with a ~4 MB obfuscator.io-obfuscated bundle (hex string-array, rotating while(!![]) decoder IIFE, control-flow flattening, ~23,890-entry string array). index.js requires('./lib/config') at top level, so this opaque payload executes on any require('solidity-hold'). The advertised middleware export is a no-op stub, and the package declares an axios dependency (network egress capability) that a logger does not need. Publisher metadata (author Jackson Blau <[email protected]>, bugs URL jsonspack.com/issues) is unrelated to the pino project whose code and branding are copied. Heavy control-flow obfuscation of an auto-executing module inside a package that impersonates a widely used dependency is a payload-carrier shape hostile to any installer that requires the module.

    References: https://www.npmjs.com/package/solidity-hold/v/2.0.1

    Affected packages

    Package

    Name: solidity-hold

    Purl: pkg:npm/solidity-hold

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1
    MAL-2026-14220 | CVE-DB