hardhat-bits
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for hardhat-bits@2.21.0, the only known version.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package entrypoint loads a heavily obfuscated module that invokes shell execution and includes network capability. This concrete, reachable behavior warrants blocking despite the exact command and endpoint being obscured.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Requiring the package entrypoint imports `lib/config.js`.
Impact
The opaque imported code can execute shell commands and make network requests during module loading; the precise command and remote effect are not established from the inspected excerpts.
Mechanism
The config module imports Axios and child-process APIs; it invokes `execSync` with a command assembled through obfuscated helpers.
Attack narrative
The declared entrypoint imports `lib/config.js` immediately. That 4.4 MB single-line file is heavily obfuscated and includes Axios, OS/filesystem access, and an `execSync` call with an obfuscated command. This is a concrete, reachable execution surface whose purpose cannot be explained from the inspected source excerpts.
AI rationale
The package entrypoint loads a heavily obfuscated module that invokes shell execution and includes network capability. This concrete, reachable behavior warrants blocking despite the exact command and endpoint being obscured.
Evidence
index.jslib/config.js
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` imports `lib/config.js` at module load, making the obfuscated file reachable from the declared entrypoint.
- `lib/config.js` uses heavily obfuscated code and imports OS, filesystem, path, and child-process APIs.
- `lib/config.js` invokes `execSync` with an obfuscated command assembled from helper calls.
- `lib/config.js` imports Axios and constructs obfuscated URL strings, supporting network-capable behavior.
Evidence against
Behavioral surface
ChildProcessEnvironmentVars
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
lib/config.js4.26 MB file, sampled 256 KB
HighEntropyStringsMinified
Source & flagged code
7 flagged · loading sourceindex.jsView file
3const path = require('path');
L4: const { spawn } = require('child_process');
L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
High
3const path = require('path');
const { spawn } = require('child_process');
const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
const config
High
Ai Review Evidence
`index.js` imports `lib/config.js` at module load, making the obfuscated file reachable from the declared entrypoint.
index.jsView on unpkg · L3lib/config.jsView file
1function Y(L,m){const K=R();Y=function(f,H){f=f-(-0x1aa5+0x1ee1+-0x1*0x3ad);let U=K[f];if(Y['\x6c\x4a\x73\x6a\x61\x48']===undefined){var j=function(q){const s='\x61\x62\x63\x64\x65...
Critical
Download Execute
Source downloads or fetches remote code and executes it.
lib/config.jsView on unpkg · L1Findings
2 Critical4 High3 Medium3 Low
CriticalDownload Executelib/config.js
CriticalTrigger Reachable Dangerous Capabilitylib/config.js
HighChild Processindex.js
HighSemantic Analysis Limitedlib/config.js
HighAi Review Evidenceindex.js
HighAi Review Evidencelib/config.js
MediumEnvironment Vars
MediumOversized Source Filelib/config.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hardhat-bits@2.21.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing hardhat-bits@2.21.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.