Loading npm security reports…

hardhat-plus@2.21.0: Malicious npm security report (Block) | LPM Firewall

registry / hardhat-plus / 2.21.0

hardhat-plus@2.21.0

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Importing the package loads an obfuscated module containing shell execution and network request code. Their effective behavior remains unresolved, so no confirmed attack is established.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing index.js loads lib/config.js; additional internal conditions remain obscured.

Impact

Potential command execution and transmission of collected information warrant warning; specific harmful effects are unconfirmed.

Mechanism

Encoded string lookups conceal shell commands and network request details in the imported module.

AI rationale

Source inspection establishes obscured shell and network behavior reachable through an imported module, supporting a warning. The inspected evidence does not establish malicious commands or an unauthorized recipient strongly enough to justify blocking.

Evidence

index.jslib/config.js

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17508

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in hardhat-plus (npm)

Details

hardhat-plus@2.21.0 is published under a name resembling the Ethereum development tool 'hardhat' but ships README, type definitions, and docs copied verbatim from the unrelated pino logger project (README.md references npmjs.com/package/pino; index.d.ts references github.com/pinojs/pino.git; package.json description is unrelated boilerplate). The package's main entry index.js requires./lib/config, which is a single ~4.5MB heavily obfuscated file using obfuscator.io transforms: hex-named identifiers, a self-mutating shuffled string-array (while(!![]){...f['push'](f['shift']())}), control-flow flattening, dispatched decode helpers, and pervasive \xNN escape literals. This opaque code runs unconditionally the moment the package is imported. There is no legitimate source, minification story, or documented purpose that accounts for a multi-megabyte obfuscated blob being loaded as a 'config' module in a package that presents itself as either a Hardhat plugin or a pino logger. The combination of name-based impersonation, mismatched cover-story documentation, and an obfuscated payload auto-executed on import is the standard delivery shape for supply-chain malware.

Source & flagged code

7 flagged · loading source

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6const config = require('./lib/config'); const { pid } = process; const defau

High

Ai Review Evidence

package.json selects index.js as the entrypoint; index.js immediately loads lib/config.js.

index.jsView on unpkg · L6

lib/config.jsView file

1function gP(z,w,f,S,C){const FR={z:0x1ad};return F(C-FR.z,z);}(function(z,w){const Fu={z:0x3a62,w:0x436a,f:0x6ac5,S:0x1edf,C:0x307e,y:0x586b,l:0x66fa,a:0x5fe2,k:0x610c,o:0x7d37,M:0...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function gP(z,w,f,S,C){const FR={z:0x1ad};return F(C-FR.z,z);}(function(z,w){const Fu={z:0x3a62,w:0x436a,f:0x6ac5,S:0x1edf,C:0x307e,y:0x586b,l:0x66fa,a:0x5fe2,k:0x610c,o:0x7d37,M:0...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

•path = lib/config.js kind = oversized_source_file sizeBytes = 4516673 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/config.jsView on unpkg

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" }, "keywords": [

High

Ai Review Evidence

package.json selects index.js as the entrypoint; index.js immediately loads lib/config.js.

package.jsonView on unpkg · L5

Source & flagged code

7 flagged

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6const config = require('./lib/config'); const { pid } = process; const defau

High

Ai Review Evidence

package.json selects index.js as the entrypoint; index.js immediately loads lib/config.js.

index.jsView on unpkg · L6

lib/config.jsView file

1function gP(z,w,f,S,C){const FR={z:0x1ad};return F(C-FR.z,z);}(function(z,w){const Fu={z:0x3a62,w:0x436a,f:0x6ac5,S:0x1edf,C:0x307e,y:0x586b,l:0x66fa,a:0x5fe2,k:0x610c,o:0x7d37,M:0...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function gP(z,w,f,S,C){const FR={z:0x1ad};return F(C-FR.z,z);}(function(z,w){const Fu={z:0x3a62,w:0x436a,f:0x6ac5,S:0x1edf,C:0x307e,y:0x586b,l:0x66fa,a:0x5fe2,k:0x610c,o:0x7d37,M:0...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

•path = lib/config.js kind = oversized_source_file sizeBytes = 4516673 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/config.jsView on unpkg

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" }, "keywords": [

High

Ai Review Evidence

package.json selects index.js as the entrypoint; index.js immediately loads lib/config.js.

package.jsonView on unpkg · L5