hardhat-kex@2.0.1
OpenSSF/OSV Malicious Advisory
imported 1mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17559 confirms this npm version as malicious.
Advisory
MAL-2026-17559
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in hardhat-kex (npm)
Details
The npm package hardhat-kex@2.0.1 ships an obfuscated 4.5MB single-line bundle at lib/config.js (obfuscator.io-style string-array with a 26,234-entry table and numeric-dispatch wrapper, containing exec strings). The package main index.js unconditionally executes this bundle on require via `const config = require('./lib/config')`; the return value is never used, so the sole effect of importing the package is to run the obfuscated code. The surface API exported by index.js is an unrelated stub Express middleware that calls `next()`. The tarball additionally ships verbatim files from the pino logging library (lib/proto.js, levels.js, transport.js, worker.js, redaction.js, docs/, index.d.ts, README.md) despite the package being named for the Hardhat/Ethereum ecosystem and describing itself as a vulnerability-management tool; none of the pino sources are reachable through the exported API. The name/description/API mismatch combined with bundled pino cover-story files is a decoy pattern designed to make the tarball appear legitimate while the obfuscated loader is the only code that actually runs. Any project adding hardhat-kex as a dependency will execute the opaque payload on import.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Source inspection confirms concealed shell execution in an import-loaded file, leaving a concrete unresolved risk. A malicious blocking verdict would require establishing the decoded command or another concrete attack chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing index.js loads lib/config.js; internal conditions govern command execution.
Impact
Potential execution of concealed shell commands with the importing process's privileges; exact effects are unresolved.
Mechanism
The configuration file constructs shell commands through string decoders and passes them to execSync.
AI rationale
Source inspection confirms concealed shell execution in an import-loaded file, leaving a concrete unresolved risk. A malicious blocking verdict would require establishing the decoded command or another concrete attack chain.
Evidence
index.jslib/config.js
Independent scan evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- package.json selects index.js as the entrypoint and declares only smoke scripts.
- index.js unconditionally loads lib/config.js on import.
- lib/config.js loads filesystem and operating-system modules and imports command execution functions through concealed module names.
- lib/config.js calls execSync with a command assembled from obfuscated string decoders; the command's purpose remains unresolved.
Evidence against
- No npm installation lifecycle hook or runtime self-dependency is declared.
- Inspected source does not establish a remote payload destination, credential export, or destructive command.
Behavioral surface
ChildProcessEnvironmentVars
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
Source & flagged code
7 flaggedindex.jsView file
3const path = require('path');
L4: const { spawn } = require('child_process');
L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
High
6const config = require('./lib/config');
const { pid } = pr
High
lib/config.jsView file
1(function(a,z){const kR={a:0x1654,z:0x72b,n:0x230f,H:0xdd5,m:0x1361,p:0x204,W:0x19f1,F:0x4a6b,P:0x1aad,o:0x3d64,j:0x3fc9,d:0x581e,l:'\x30\x33\x7a\x66',I:0x655a,K:0x7e23,V:0x8934,O:...
Critical
Download Execute
Source downloads or fetches remote code and executes it.
lib/config.jsView on unpkg · L1Findings
2 Critical4 High3 Medium3 Low
CriticalDownload Executelib/config.js
CriticalTrigger Reachable Dangerous Capabilitylib/config.js
HighChild Processindex.js
HighSemantic Analysis Limitedlib/config.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
MediumEnvironment Vars
MediumOversized Source Filelib/config.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hardhat-kex@2.0.1.
See all versions of hardhat-kex for other recorded verdicts.
- Avoid installing hardhat-kex@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.