registry / hardhat-devkit / 2.3.6

hardhat-devkit@2.3.6

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Importing the package runs packed lib/config.js, which fingerprints the host and uses axios plus Function and execSync to fetch and run extra code. Copied Pino files and a no-op middleware hide that dropper.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any install or runtime import of hardhat-devkit, including require of index.js.

Impact

The importing process can run attacker-chosen code, spawn shell commands, and send host identity to a remote server.

Mechanism

Import-time obfuscated dropper with remote fetch and local command execution

Attack narrative

When an app imports hardhat-devkit, index.js immediately requires lib/config.js. That file is packed obfuscated code, not logger setup. It fingerprints host, operating system, and username, posts with axios, builds a Function from decoded text, and runs execSync or spawn. Copied Pino docs and an empty Express middleware hide this import-time dropper. There is no Hardhat or logging reason for that chain.

AI rationale

Importing the package runs a packed dropper that collects host identity, talks over axios, and executes decoded code with Function and execSync. The Pino-looking docs and empty middleware do not explain that behavior.

Evidence

package.jsonindex.jslib/config.js

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16349

Source

Package published as `hardhat-devkit` presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README, index.d.ts, and keywords (`fast`, `logger`, `stream`, `json`) are copied from `pinojs/pino`, the manifest description references vulnerability management, and the homepage points at `jsonspack.com` (author `hello@jsonspack.com`). The package's `index.js` unconditionally executes `require('./lib/config')` on load. `lib/config.js` is a single-line ~4,070,107-byte JavaScript file heavily obfuscated with obfuscator.io techniques: hex-escaped identifiers and property names (`_0xNNNN`, `\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74`), a self-mutating string-array indexer with an embedded RC4+base64 string decoder (`J[v]=J[W]; e+=String.fromCharCode(N.charCodeAt(a)^J[(J[v]+J[W])%256])`), control-flow flattening via a `while(!![]){try{...}catch{}}` dispatcher, and a debugger-defense self-check. This concealed payload runs on any `require('hardhat-devkit')` or `import` of the package, targeting an audience (Ethereum developers) whose machines are likely to hold wallet keystores, mnemonics, and deployment keys. The combination of brand impersonation, mismatched cover-story metadata copied from an unrelated legitimate project, and a multi-megabyte obfuscated blob reachable at module load time is the supply-chain dropper shape.

hardhat-devkit@2.3.6

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code