hardhat-devkit

GHSA-2wmg-qp72-3736

Malicious code in hardhat-devkit (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.3.6`

## Source: amazon-inspector (ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95)
Package published as `hardhat-devkit` presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README, index.d.ts, and keywords (`fast`, `logger`, `stream`, `json`) are copied from `pinojs/pino`, the manifest description references vulnerability management, and the homepage points at `jsonspack.com` (author `[email protected]`). The package's `index.js` unconditionally executes `require('./lib/config')` on load. `lib/config.js` is a single-line ~4,070,107-byte JavaScript file heavily obfuscated with obfuscator.io techniques: hex-escaped identifiers and property names (`_0xNNNN`, `\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74`), a self-mutating string-array indexer with an embedded RC4+base64 string decoder (`J[v]=J[W]; e+=String.fromCharCode(N.charCodeAt(a)^J[(J[v]+J[W])%256])`), control-flow flattening via a `while(!![]){try{...}catch{}}` dispatcher, and a debugger-defense self-check. This concealed payload runs on any `require('hardhat-devkit')` or `import` of the package, targeting an audience (Ethereum developers) whose machines are likely to hold wallet keystores, mnemonics, and deployment keys. The combination of brand impersonation, mismatched cover-story metadata copied from an unrelated legitimate project, and a multi-megabyte obfuscated blob reachable at module load time is the supply-chain dropper shape.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7472198c41a4f2e84042517b2779dc96a7e527af/osv/malicious/npm/hardhat-devkit/MAL-2026-16349.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7472198c41a4f2e84042517b2779dc96a7e527af/osv/malicious/npm/hardhat-devkit/MAL-2026-16349.json
- https://www.npmjs.com/package/hardhat-devkit/v/2.3.6
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/hardhat-devkit/MAL-2026-16349.json
- https://www.npmjs.com/package/hardhat-devkit/v/2.0.1
- https://github.com/advisories/GHSA-2wmg-qp72-3736

Compromised versions (1)

= 2.3.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.