hardhat-hold@2.21.0

High-risk behavior combination matched malicious policy.

Any runtime require/import of hardhat-hold.

Potential credential theft, remote communication, and persistent/background execution in the importing user's environment.

Obfuscated import-time credential-targeting payload with process execution and network capability.

The advertised entrypoint imports lib/config.js before exporting middleware. That file is a multi-megabyte obfuscated payload that performs dependency/bootstrap handling through execSync, loads Axios, includes detached child-process behavior, and references AWS credential locations. These capabilities are unrelated to the package's trivial middleware export and execute on ordinary import, forming a concrete malicious chain.

This is not a benign logger/middleware implementation: its entrypoint activates an opaque payload with credential-targeting, networking, and execution capabilities. The lack of an install hook does not mitigate import-time execution.