solidity-lock

Details

**Severity:** Critical

**Affected versions:** `= 2.21.0`

## Source: amazon-inspector (7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8)
The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require('./lib/config'), a ~4 MB obfuscator.io-style bundle (rotating string array, hex-escaped entries, self-executing IIFE) that runs at import time. Package identity does not match the shipped code: package.json name is 'solidity-lock' with a vulnerability-management description, keywords advertise a logger ('fast','logger','stream','json'), scripts are 'smoke:pino'/'smoke:file', the README is a copy of pino's README with the name changed, and index.d.ts references pinojs/pino — three inconsistent cover stories layered over the opaque payload. axios ^1.10.0 is declared as a dependency but is not referenced anywhere in the plain-text sources; the only plausible consumer is the obfuscated blob, consistent with outbound HTTP from the hidden payload. Any process that requires this package executes the obfuscated bundle in-process with full host privileges.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d7d3c91983ca43b861eb619ab6d817344dac390b/osv/malicious/npm/solidity-lock/MAL-2026-17302.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d7d3c91983ca43b861eb619ab6d817344dac390b/osv/malicious/npm/solidity-lock/MAL-2026-17302.json
- https://www.npmjs.com/package/solidity-lock/v/2.21.0
- https://github.com/advisories/GHSA-8gw4-ghf8-h8pw

Compromised versions (1)

• = 2.21.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.