hardhat-cap

{"modified":"2026-08-07T16:30:20Z","published":"2026-08-07T16:30:20Z","schema_version":"1.7.4","id":"MAL-2026-13616","summary":"Malicious code in hardhat-cap (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8)\nThe package is published as `hardhat-cap` but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger, with author metadata pointing at jsonspack.com. index.js unconditionally does `const config = require('./lib/config');`, and lib/config.js is a ~4 MB single-line obfuscator.io-transformed module (rotated string array of ~23,931 entries, dual decoders, RC4+base64 string decoding, control-flow flattening) whose top-level IIFE self-invokes at load time. Requiring the package executes this opaque payload on the installer's host at import time; the surrounding pino code is unrelated cover. A logger has no need for a multi-megabyte obfuscated self-decoding blob, and the name/contents mismatch (Hardhat-themed name, pino source, obfuscated third module) is consistent with a typosquat lure that drops arbitrary code execution into consumers on `require`.\n","affected":[{"package":{"ecosystem":"npm","name":"hardhat-cap"},"versions":["2.21.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"c9b83cdf9b6c915f02485cce0d993653a07cb78d12317904270f808e65529c30","tlsh":"ab1674488181f02393cd5b63bf457aecfc7a68a694cc654b8559bd2de8bc40bd9e2cc4"},{"path":"package.json","sha256":"b368dc0c975566bf937ccfb42399ffd527e264938667ffeb9d8650a23f9f0e5f","tlsh":"75017620deb88e2301ed25424c2a0643b6618c175528fc2933dba12c0fad5fb41ff22e"}],"package_integrity":[{"filename":"hardhat-cap-2.21.1.tgz","hashes":{"sha1":"ef146a433a457ff4dac5728945c83dd5974a7705","sha512_sri":"sha512-HdE46WfA9sGKDSD1vjxIVLJOhVeHpLwC2VketanM9TjPN5dAW8ATNiOpYvVVV+uLPven2MXUsIGW3Fwfy5xIjQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-cap/v/2.21.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017106","import_time":"2026-08-07T16:51:14.081656136Z","modified_time":"2026-08-07T16:30:20Z","sha256":"f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8","source":"amazon-inspector","versions":["2.21.1"]}]}}