solidity-map

{"modified":"2026-10-26T00:00:00Z","published":"2026-10-26T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-18696","summary":"Malicious code in solidity-map (npm)","details":"solidity-map ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof (MAL-2026-17509) and chai-foundry (MAL-2026-13356) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.","affected":[{"package":{"ecosystem":"npm","name":"solidity-map"},"versions":["2.21.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solidity-map"},{"type":"WEB","url":"https://osv.dev/vulnerability/MAL-2026-17509"}],"credits":[{"name":"CyberXYZ","type":"FINDER","contact":["https://cyberxyz.io"]}],"database_specific":{"iocs":{"domains":[],"files":[{"digests":{"sha256":"4e6c4e61a7019ab0affe9c2d20e36701b330ec357be205930355bac1464f9316"},"paths":["index.js"]},{"digests":{"sha256":"7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb"},"paths":["lib/config.js"]}],"ips":[],"urls":[]}}}