MAL-2026-17659

    Dashboard / Malicious Package / MAL-2026-17659

    MAL-2026-17659

    Published: 8 Oct 2026Last Modified: 8 Oct 2026

    Summary: Malicious code in hardhat-deep (npm)

    Details: Source: amazon-inspector (fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304) The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree (README, SECURITY.md, index.d.ts, lib/proto.js, lib/transport.js, lib/worker.js, lib/levels.js, lib/multistream.js, etc.) verbatim, while the package name and manifest description target the Hardhat ecosystem. The only novel file is lib/config.js, a single-line 4,499,968-byte obfuscator.io bundle with a 26,234-entry rotated string array, two decoder functions, hex-encoded strings and control-flow flattening. The package's top-level index.js is modified from pino's original to unconditionally `require('./lib/config')`, so any consumer that `require`s or `import`s hardhat-deep executes this opaque payload inside the installer's Node process. The exported middleware is a no-op cover with no logger functionality, so running the obfuscated blob is the only effect of installing or loading the package. The author identity (Robert King <[email protected]>, jsonspack.com) is unrelated to either Hardhat or pinojs.

    References: https://www.npmjs.com/package/hardhat-deep/v/2.0.1

    Affected packages

    Package

    Name: hardhat-deep

    Purl: pkg:npm/hardhat-deep

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1