MAL-2026-17560

    Dashboard / Malicious Package / MAL-2026-17560

    MAL-2026-17560

    Published: 5 Oct 2026Last Modified: 5 Oct 2026

    Summary: Malicious code in hardhat-spack (npm)

    Details: Source: amazon-inspector (e59c971c63de9d0a7f66c26093f528164990af10eca00a3a36b97d0c8b0a6d0d) The package is published as hardhat-spack but presents itself internally as a pino-like logger. Its main export is a middleware factory that spawns lib/caller.js as a detached child process. caller.js and lib/const.js define a fake process.env object whose DEV_API_KEY, DEV_SECRET_KEY, and DEV_SECRET_VALUE are base64 blobs; DEV_API_KEY decodes to https://iphub-encrypted.vercel.app/api/auth/f1f097d93c318c92f0c5. caller.js base64-decodes that URL, POSTs to it, and passes the response body to `new Function.constructor("require", s)` and invokes it with the real require, giving the fetched JavaScript full Node capabilities (filesystem, child_process, network). The request is retried up to five times and failures are swallowed. The destination host is disposable Vercel infrastructure unrelated to any declared purpose, the URL and credential-shaped values are concealed with base64, and the executed code is attacker-mutable at any time.

    References: https://www.npmjs.com/package/hardhat-spack/v/3.0.2

    Affected packages

    Package

    Name: hardhat-spack

    Purl: pkg:npm/hardhat-spack

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.2