solidity-hold

{"modified":"2026-08-19T03:03:18Z","published":"2026-08-19T03:03:18Z","schema_version":"1.7.4","id":"MAL-2026-14220","summary":"Malicious code in solidity-hold (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f)\nThe npm package solidity-hold@2.0.1 impersonates the popular pino logger: the README badges and lib/ source tree are copied from pino (pinojs/pino), but lib/config.js is replaced with a ~4 MB obfuscator.io-obfuscated bundle (hex string-array, rotating while(!![]) decoder IIFE, control-flow flattening, ~23,890-entry string array). index.js requires('./lib/config') at top level, so this opaque payload executes on any require('solidity-hold'). The advertised middleware export is a no-op stub, and the package declares an axios dependency (network egress capability) that a logger does not need. Publisher metadata (author Jackson Blau <hello@jsonspack.com>, bugs URL jsonspack.com/issues) is unrelated to the pino project whose code and branding are copied. Heavy control-flow obfuscation of an auto-executing module inside a package that impersonates a widely used dependency is a payload-carrier shape hostile to any installer that requires the module.\n","affected":[{"package":{"ecosystem":"npm","name":"solidity-hold"},"versions":["2.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/config.js","sha256":"1176d4dea79d83166810bfe267ee4e31daa9c1b6d31c351c126bca6b1afb6a61","tlsh":"d91685889245c523d2cc13a3be557aa9f13aa96584ccb607edf9bd6cb4bc807c0b5dd0"},{"path":"README.md","sha256":"6bc462e6cb74540d67c9f92b21b46eeca394d8989289faffc3ee4dac407b5379","tlsh":"7c41666787e46b794b6301b192c275a5ff6fa31c3b5e60a5dcac8129131c592813124e"}],"package_integrity":[{"filename":"solidity-hold-2.0.1.tgz","hashes":{"sha1":"6d0b2689a855b4638bcab926032d3be7e2550614","sha512_sri":"sha512-ioOg6NmliJw4DsZ/TRicB+oPp+5nPIVaNTUfmzz0qma4YCPoJhwXnYMmUelFIrnikXfwXPCOAJQKGdBrnE9RhA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solidity-hold/v/2.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018320","import_time":"2026-08-19T03:24:21.741324417Z","modified_time":"2026-08-19T03:03:18Z","sha256":"39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f","source":"amazon-inspector","versions":["2.0.1"]}]}}