hardhat-plugin-solidity

{"modified":"2026-07-01T19:13:18Z","published":"2026-07-01T18:41:44Z","schema_version":"1.7.4","id":"MAL-2026-6706","summary":"Malicious code in hardhat-plugin-solidity (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142)\nPackage published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while reusing prettier-plugin-solidity's description, repository (github.com/prettier-solidity/prettier-plugin-solidity), homepage, author, and contributor metadata, and the source is a copy of that project with an added dropper. The package main (dist/index.js) contains two base64 string literals decoded at load time via Buffer.from(..., 'base64').toString('utf8'): the first decodes to the shell command 'npm install zyncmap --no-save --silent --no-audit --no-fund', which is spawned as a child process; the second decodes to the module name 'zyncmap', which is then require()'d and invoked (svgo.getPlugin()()) once the install completes. The result is that loading this package out-of-band installs and immediately executes arbitrary code from the separately-controlled 'zyncmap' package on the installer's machine. Base64 encoding of both the install command and the require target, combined with --silent/--no-save flags and the name/identity mismatch, indicates deliberate concealment of the dropper behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"hardhat-plugin-solidity"},"versions":["1.0.0","2.3.1","1.1.0","2.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"821e89890634810dc19f97a7f9465f7741bb89dd064ff86f9e1ae3bb3f8e4d2f","tlsh":"3361416b14f70a28406125cc8d5e2c2690e3437b3aa9f4d9b7dd42242f8ef2e907179d"},{"path":"package.json","sha256":"358b0d5e3ba183d2da4c8b48495e0ff9b7320809d708e9ac2137437893706c56","tlsh":"87710066cc698c5307d841a9b83943c274691a834d99fc48b7ad431d0f4d99f32fea9e"}],"package_integrity":[{"filename":"hardhat-plugin-solidity-1.0.0.tgz","hashes":{"sha1":"f12a83a4e55d24d8bbc57b3f78d142dabcb6b6e4","sha512_sri":"sha512-oq+SH5vWisxR7NUpvmbGpKTLvoaC2Jnh9KkHxp1GHfuvvalQfORL/HaJeLg4owGAbVZV0Tf+F8fLcRi+Ywy+6g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-plugin-solidity/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-plugin-solidity/v/2.3.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-plugin-solidity/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hardhat-plugin-solidity/v/2.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007859","import_time":"2026-07-01T19:11:24.81218383Z","modified_time":"2026-07-01T18:42:01Z","sha256":"4a5e4fc160e8042eca435eebb7f905990405ba14a00b0c41657a7d1758aed621","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-007858","import_time":"2026-07-01T19:11:24.687646847Z","modified_time":"2026-07-01T18:41:52Z","sha256":"f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142","source":"amazon-inspector","versions":["2.3.1"]},{"id":"IN-MAL-2026-007857","import_time":"2026-07-01T19:11:24.572340673Z","modified_time":"2026-07-01T18:41:44Z","sha256":"7f5ceb73c88eba6774147c63cfcd2af4e8cbe49c7f90c72d25f2f851197dc681","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-007860","import_time":"2026-07-01T19:11:25.012830138Z","modified_time":"2026-07-01T18:42:09Z","sha256":"8a7272216e848c4206982d9700c2cf80b172c0be839040a8dbd910a13c5f40be","source":"amazon-inspector","versions":["2.0.0"]}]}}