Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

hardhat-cap@2.21.1: Malicious npm security report (Block) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Unconsented host access and remotely directed malicious behavior may occur at import time.

View on npm All versions

registry / hardhat-cap / 2.21.1

hardhat-cap@2.21.1

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Importing the package loads an opaque, obfuscated payload before the exported middleware is used. The payload dynamically decodes behavior and includes filesystem and network-capable logic.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

require/import of hardhat-cap

Impact

Unconsented host access and remotely directed malicious behavior may occur at import time.

Mechanism

eager execution of obfuscated dynamic payload

Attack narrative

The main entrypoint immediately imports lib/config.js. That file is an unusually large, deliberately obfuscated payload with runtime decoding, indirect dynamic execution, filesystem traversal, and HTTP/HTTPS handling; these capabilities are unrelated to the exported no-op middleware. Its opacity prevents safe attribution to a legitimate package function and creates an import-time execution surface.

Rationale

Source inspection confirms an import-reachable opaque payload with dynamic execution and host/network-capable primitives, not merely scanner labeling. Absence of lifecycle hooks does not mitigate runtime import execution.

Evidence

package.jsonindex.jslib/config.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13616

Source

OpenSSF Malicious Packages via OSV

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Summary

Source inspection confirms an import-reachable opaque payload with dynamic execution and host/network-capable primitives, not merely scanner labeling. Absence of lifecycle hooks does not mitigate runtime import execution.

References

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js eagerly requires ./lib/config on import.
lib/config.js is a 4.06 MB single-line, heavily obfuscated executable payload.
lib/config.js contains runtime string decryption and indirect Function/global-object construction.
lib/config.js includes obfuscated filesystem traversal and HTTP/HTTPS URL handling.

Evidence against

package.json has no install lifecycle hooks.
index.js exports a superficially benign middleware wrapper.

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 307 KB of source, external domains: github.com

Oversized source lightweight scan

lib/config.js3.87 MB file, sampled 256 KB

HighEntropyStringsMinified

Source & flagged code

5 flagged · loading source

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

lib/config.jsView file

1function yS(F,S,Y,E,i){const Fq={F:0x6e};return T(i-Fq.F,S);}function yY(F,S,Y,E,i){const FC={F:0x49};return T(i-FC.F,S);}function yn(F,S,Y,E,i){const Fn={F:0x1ba};return j(S- -Fn....

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function yS(F,S,Y,E,i){const Fq={F:0x6e};return T(i-Fq.F,S);}function yY(F,S,Y,E,i){const FC={F:0x49};return T(i-FC.F,S);}function yn(F,S,Y,E,i){const Fn={F:0x1ba};return j(S- -Fn....

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

lib/tools.jsView file

•matchType = malicious_source_fingerprint_signature signature = 8d2e4ca7c22e8649 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hardhat-set@2.21.0 matchedPath = lib/tools.js matchedIdentity = npm:aGFyZGhhdC1zZXQ:2.21.0 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/tools.jsView on unpkg

Findings

2 Critical3 High2 Medium3 Low

CriticalDownload Executelib/config.js

CriticalTrigger Reachable Dangerous Capabilitylib/config.js

HighChild Processindex.js

HighSemantic Analysis Limitedlib/config.js

HighKnown Malware Source Fingerprint Signaturelib/tools.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

97%Block

Verdict confidence

IntentMalware

TypeMalware

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

AuthorRobert King

Version2.21.1

PublishedAug 7, 2026

LicenseMIT

Dependencies2

Integrityverified

Package size1.50 MB

Files42

Keywordsfastloggerstreamjson

Runtime surface

package.json

Entrypointsmain → index.jstypes → ./index.d.ts

RuntimeNo engine / OS / CPU constraints

Artifact4.13 MB · 42 files1 signature(s)

Install lifecycleNo install hooks · other: smoke:file, smoke:pino

Behavioral surface

ChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

index.jsView file

Lines 1-23javascript

1'use strict';

2

3const path = require('path');

4const { spawn } = require('child_process');

5const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6const config = require('./lib/config');

7

8const { pid } = process;

9

10const defaultOptions = {

11 levelComparison: SORTING_ORDER.ASC,

12 levels: DEFAULT_LEVELS,

13 messageKey: 'msg',

14 errorKey: 'err',

15 nestedKey: null,

16 enabled: true,

17 base: { pid },

18 formatters: Object.assign(Object.create(null), {

19 bindings(bindings) {

20 return bindings;

21 }

22 }),

23 hooks: {

lib/config.jsView file

1function yS(F,S,Y,E,i){const Fq={F:0x6e};return T(i-Fq.F,S);}function yY(F,S,Y,E,i){const FC={F:0x49};return T(i-FC.F,S);}function yn(F,S,Y,E,i){const Fn={F:0x1ba};return j(S- -Fn....

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function yS(F,S,Y,E,i){const Fq={F:0x6e};return T(i-Fq.F,S);}function yY(F,S,Y,E,i){const FC={F:0x49};return T(i-FC.F,S);}function yn(F,S,Y,E,i){const Fn={F:0x1ba};return j(S- -Fn....

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

lib/tools.jsView file

•matchType = malicious_source_fingerprint_signature signature = 8d2e4ca7c22e8649 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hardhat-set@2.21.0 matchedPath = lib/tools.js matchedIdentity = npm:aGFyZGhhdC1zZXQ:2.21.0 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/tools.jsView on unpkg