MAL-2026-13609
Malicious code in hardhat-set (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (7cf6b9d0ee4a23bfab6e7a3c21f69a36e0655019cf1dd602f93760e233c7f701) The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project (github.com/pinojs/pino), while package.json declares author 'Robert King <hello@jsonspack.com>' with bugs URL 'https://jsonspack.com/issues'. index.js executes `const config = require('./lib/config')` at load time; lib/config.js is a 4,060,622-byte single-line file packed with obfuscator.io (23,931-entry rotated string array, RC4/base64 string decoder, control-flow flattening, self-defending checks) and runs a top-level IIFE on require. No other file in the package references config's exports, and pino itself contains no such module. The combination of a name/README mismatch (pino cover story on a package named after Hardhat), an unrelated author domain, and a multi-megabyte obfuscated blob that self-executes on import is a masquerade/typosquat delivering a hidden payload to anyone who installs or requires the package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for hardhat-set (npm). Pin to a known-safe version or switch to an alternative.