registry / hardhat-zet / 2.0.1

hardhat-zet@2.0.1

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing hardhat-zet evaluates index.js, which loads an obfuscated lib/config.js payload. That payload pulls in child_process and can run a hidden execSync command, and it also contains code that fingerprints the host and posts those details with axios.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any import or node load of the package main entry index.js.

Impact

A consumer process can execute an attacker-controlled command and expose host identity. The exact command text and destination stay hidden by the obfuscation.

Mechanism

lib/config.js runs on load, decodes strings, requires system modules, fingerprints the machine, and calls execSync under an obfuscated platform check. A separate helper posts host, username, and message data and can require a module from the reply.

Attack narrative

hardhat-zet presents itself as a logger, but its entry file loads lib/config.js as soon as the package is imported. That file is a multi-megabyte obfuscated loader. On load it requires operating-system, filesystem, and child-process APIs, records hostname and username, and in a platform check calls execSync on a decoded command. The same file also contains an axios routine that sends host, user, and message fields and can load a module from the response. No install hook is required; importing the package is enough to reach the loader.

AI rationale

Importing the package runs an obfuscated loader that shells out through execSync and prepares host and username collection plus an axios send. That is concrete remote command execution hidden behind a logger-shaped entry, not ordinary package behavior.

Evidence

package.jsonindex.jslib/config.js

OSV advisory

hardhat-zet@2.0.1 is published under a name that impersonates the Hardhat Ethereum tooling ecosystem, but its README, type definitions and docs/ tree are copied verbatim from the unrelated `pino` logger project (badges and links point at npmjs.com/package/pino and github.com/pinojs/pino). The exported `middleware` in index.js is a no-op Express middleware and matches neither the `hardhat-zet` name nor the pino README. The package's declared main (index.js) top-level-requires./lib/config, which is not a configuration file but a 4,498,609-byte obfuscator.io-style bundle: a 26,113-entry rotated string array behind two runtime decoders (functions v and F), hex-encoded identifiers, and control-flow flattening. All strings and destination URLs are hidden behind the decoders, so this code runs automatically on any `require('hardhat-zet')` and its behavior is not observable without deobfuscation. Publisher metadata (author 'Robert King <hello@jsonspack.com>', bugs URL https://jsonspack.com/issues) ties to neither the Hardhat nor the pino identity. The combination — ecosystem-typosquat name targeting crypto/Hardhat developers, cover-story README lifted from an unrelated popular package, no-op public API, and a multi-megabyte obfuscated payload auto-executed on import — is the shape of a supply-chain stealer aimed at Ethereum developers. ## Source: ghsa-malware (781273d2c802d3781fecccd4434ba418c93ce88edf920b2a1163dbacf7576254) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

hardhat-zet@2.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code