hardhat-gas-tracker

{"schema_version":"1.7.4","id":"MAL-2026-11020","published":"2026-07-22T23:22:56Z","modified":"2026-08-05T13:10:40.812622384Z","summary":"Malicious code in hardhat-gas-tracker (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8f908ec767bb48d5cf889b1035fc89ff03d0422bfa043e3c361c4faf0002df95)\nOn module load, the package schedules a randomized 5-15 second setTimeout that POSTs a JSON body containing os.hostname(), os.userInfo().username, os.homedir(), and the full process.env dump to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/beacon. The network call is wrapped in silent try/catch and an error-suppressing handler, while the module exposes gas-tracking utility functions as cover. In a Hardhat context, process.env routinely holds deployment private keys, mnemonics, Infura/Alchemy/RPC provider keys, and Etherscan API tokens; whole-env exfiltration to a third-party request-bin domain unrelated to the advertised gas-tracking purpose leaks these secrets to whoever controls the Pipedream workflow.\n\n## Source: ossf-package-analysis (bc0a3828194aac457c89426a616772e54d6aa3868e1b0980b3e31bbbb20808c9)\nThe OpenSSF Package Analysis project identified 'hardhat-gas-tracker' @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"hardhat-gas-tracker","ecosystem":"npm"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"6086dc2f6aa3fce37fdba1b740775acf62c7bc87915154083cb05f36eece88e5","tlsh":"074131b56979b02846b351d888a9cd1fa7abe1523a03d4e4b75d28440fcae78d8f1da0"}],"package_integrity":[{"filename":"hardhat-gas-tracker-1.0.1.tgz","hashes":{"sha1":"f2dbaef9f5b0e22a3c15076c8079c622e4f56e86","sha512_sri":"sha512-v4TOk5LN4WooL+sxR9yQzLMnVw+0kDMBFMrpoigl1QR37QxabTiU0d00VATItAAAE1X/u3jmOtTfqlC5K1tNBw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-gas-tracker/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-gas-tracker/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-22T23:26:35.512681587Z","modified_time":"2026-07-22T23:22:56Z","sha256":"bc0a3828194aac457c89426a616772e54d6aa3868e1b0980b3e31bbbb20808c9","source":"ossf-package-analysis","versions":["1.0.1"]},{"id":"IN-MAL-2026-011116","import_time":"2026-08-04T22:30:00.037878387Z","modified_time":"2026-08-04T21:34:51Z","sha256":"8f908ec767bb48d5cf889b1035fc89ff03d0422bfa043e3c361c4faf0002df95","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-014833","import_time":"2026-08-05T13:08:49.925983709Z","modified_time":"2026-08-05T12:58:55Z","sha256":"f0666022f553f3d86899c39da5708fd9658e2bebbf88bb97df923898893d454f","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}