hardhat-hold

{"modified":"2026-08-19T04:20:03Z","published":"2026-08-19T03:54:07Z","schema_version":"1.7.4","id":"MAL-2026-14246","summary":"Malicious code in hardhat-hold (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e)\nThe package's main entry index.js unconditionally requires./lib/config, which is a ~4MB obfuscator.io-style blob (string array of ~23,981 entries with a rotating decoder and hex-escaped literals). The readable identifiers inside that payload include execSync (child_process) and axios (HTTP client) — the local-execution and outbound-network primitives used by droppers and exfiltration stagers — and the payload runs at import time via a top-level IIFE. The wrapper index.js copies the pino logger API surface but never uses the config export; its only effect is to force the obfuscated blob to load on require(). The package name hardhat-hold is a one-token variant of the Ethereum tooling package hardhat, while the README impersonates the pino logger (including shields.io badges that still point at pino's repository), and package.json carries an unrelated boilerplate description about vulnerability management. The combination of name/README/description mismatch with an obfuscated import-time payload carrying shell-exec + HTTP primitives is the canonical typosquat-dropper shape.\n","affected":[{"package":{"ecosystem":"npm","name":"hardhat-hold"},"versions":["2.0.1","2.21.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0d4838d9e98f1870b3c44eadb1d0fd94e71526004752160f9db4c7d065e63874","tlsh":"5a21f1a125d6608f8938dad0f5306516acd7c677260752b2b9fc97ca27860080161fba"},{"path":"package.json","sha256":"6660bc17b196b541c78c33c69bcb8bbc9489bec99b93eebe6287a0f5d6ccee09","tlsh":"e101dd30ceb89e2301ed2552482a0603b2658c4b4528fc2833dba11c4fad1fb11ff21c"}],"package_integrity":[{"filename":"hardhat-hold-2.0.1.tgz","hashes":{"sha1":"26bac4bcd58fd6e6c0a92c85f19a72ad8d9c9e1f","sha512_sri":"sha512-BeCODNp9zLmbSG/N132Yun5P2bkCxzBtfblEsj8E2kLN2XKsYkOZZtE5OeHRvVAEPYTBPKCks6XU1b8YYZCIVA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-hold/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-hold/v/2.21.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018343","import_time":"2026-08-19T04:18:13.617667117Z","modified_time":"2026-08-19T03:54:07Z","sha256":"cc09d295042df8d7132dc5b79ae9d32ab77630db037521b333a44988aed7fac1","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-018344","import_time":"2026-08-19T04:18:13.651642008Z","modified_time":"2026-08-19T03:54:20Z","sha256":"e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e","source":"amazon-inspector","versions":["2.21.0"]}]}}