MAL-2026-17507
Dashboard / Malicious Package / MAL-2026-17507
MAL-2026-17507
Summary: Malicious code in hardhat-jsx (npm)
Details: Source: amazon-inspector (62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1) The package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger (keywords 'fast','logger','stream','json'; shipped docs reference pinojs/pino). The main entry index.js unconditionally requires./lib/config, which is a 4,499,968-byte single-line obfuscator.io artifact — a hex-escaped string array of ~26,234 entries with string-array rotation and control-flow flattening (22,707 decoder-wrapper inlines, 44,499 string-inline changes). A legitimate pino 'config' module is ~1-2KB; a multi-megabyte obfuscated blob auto-loaded by the main entry is a loader/dropper. The surface index.js exports a no-op Express-style middleware whose comment claims it 'triggers a background process', providing a cover story adjacent to the obfuscated require. Loading the package via require/import executes the opaque payload in the installer's process. The name/content mismatch (hardhat-jsx vs. pino impersonation), the stub façade, and the heavily obfuscated auto-loaded module together form a trojan-package shape.
Affected packages
Package
Name: hardhat-jsx
Purl: pkg:npm/hardhat-jsx
Affected ranges
Type: N/A
Events:
