hardhat-base

{"modified":"2026-09-21T16:43:31Z","published":"2026-09-21T16:41:31Z","schema_version":"1.7.4","id":"MAL-2026-16348","summary":"Malicious code in hardhat-base (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950)\nPackage presents itself as a pino-compatible logger (module.exports.pino = middleware; keywords fast/logger/stream/json) but ships an RCE loader. index.js spawns lib/caller.js as a detached child process on middleware invocation. caller.js reads a base64-encoded URL from a fake process.env-shaped constant (DEV_API_KEY), decodes it via atob to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5, POSTs to that endpoint via axios, and passes the response body to new Function.constructor(\"require\", s) — invoking the returned handler with the real require function. Any consumer that requires this package and calls the exported middleware fetches and executes arbitrary attacker-controlled JavaScript with full Node.js require access. The base64 concealment of the endpoint inside fake env-var constants, the detached child spawn, the cover-story pino API surface, and the mismatch with the manifest description (vulnerability-management text) confirm intentional supply-chain attack rather than an insecure update mechanism.\n","affected":[{"package":{"ecosystem":"npm","name":"hardhat-base"},"versions":["2.2.2","2.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"f9f1f0df98c19421d08ee1ff4b26abe3f90ffd1e978560bfb55033e4f3aa1b18","tlsh":"8e01bd8d60fd101c016112e5271f94325450e867394ad5d4374c93424fae6be6aa3bef"},{"path":"package.json","sha256":"4afebec15615bf48f687f274b07b562067b02548ac790c75d36039e95ceaff0f","tlsh":"99019c20ce789e2304ed25824c2a064376619c175928fc2933db612c0f9d4ff11bf21e"}],"package_integrity":[{"filename":"hardhat-base-2.2.2.tgz","hashes":{"sha1":"68beb3c8e9a4cb2416f28accf3709472e3aec549","sha512_sri":"sha512-E+ft8bsroDlkePtZCvo7aGI5f3AfXDV3uNHuNi/jES+c+HBZI5Llw1nyjUEg0EW5HN1B05TqzKg940eLufZyjA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-base/v/2.2.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-base/v/2.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020258","import_time":"2026-09-21T16:41:52.135709662Z","modified_time":"2026-09-21T16:41:31Z","sha256":"a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950","source":"amazon-inspector","versions":["2.2.2"]},{"id":"IN-MAL-2026-020259","import_time":"2026-09-21T16:41:52.18222329Z","modified_time":"2026-09-21T16:41:39Z","sha256":"bcf412ff9e25a300b1f5efafc3c0a2b3c2eaf3abdbe3bba09d9c7b7b21149b26","source":"amazon-inspector","versions":["2.2.0"]}]}}