MAL-2026-17661

    Dashboard / Malicious Package / MAL-2026-17661

    MAL-2026-17661

    Published: 8 Oct 2026Last Modified: 8 Oct 2026

    Summary: Malicious code in hardhat-pack (npm)

    Details: Source: amazon-inspector (b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02) The package is published as `hardhat-pack`, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript declarations and library source are copied verbatim from the unrelated `pino` logger. The only material divergence from upstream pino is that `index.js` adds `const config = require('./lib/config');` at the top level, and `lib/config.js` is a single-line 4.4MB obfuscator.io payload: an IIFE with a ~26,000-entry hex-escaped string array and a rotating decoder. Nothing in the shipped source references `config` for a legitimate purpose, and the package carries no native build, no vendored SDK, and no other justification for a multi-megabyte opaque blob. The package also declares `axios` as a runtime dependency, consistent with network exfiltration or remote fetch from inside the decoded payload. Any process that imports `hardhat-pack` hands the opaque payload to the JavaScript engine on first require.

    References: https://www.npmjs.com/package/hardhat-pack/v/2.0.1

    Affected packages

    Package

    Name: hardhat-pack

    Purl: pkg:npm/hardhat-pack

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1