OpenSSF/OSV advisory MAL-2026-17661 confirms this npm version as malicious. The package is published as `hardhat-pack`, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript declarations and library source are copied verbatim from the unrelated `pino` logger. The only material divergence from upstream pino is that `index.js` adds `const config = require('./lib/config');` at the top level, and `lib/config.js` is a single-line 4.4MB...
This report applies to hardhat-pack@2.0.1.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.