hardhat-zet

GHSA-qqvr-prmw-6pq2

Malicious code in hardhat-zet (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.0.1`

## Source: amazon-inspector (37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc)
[email protected] is published under a name that impersonates the Hardhat Ethereum tooling ecosystem, but its README, type definitions and docs/ tree are copied verbatim from the unrelated `pino` logger project (badges and links point at npmjs.com/package/pino and github.com/pinojs/pino). The exported `middleware` in index.js is a no-op Express middleware and matches neither the `hardhat-zet` name nor the pino README. The package's declared main (index.js) top-level-requires./lib/config, which is not a configuration file but a 4,498,609-byte obfuscator.io-style bundle: a 26,113-entry rotated string array behind two runtime decoders (functions v and F), hex-encoded identifiers, and control-flow flattening. All strings and destination URLs are hidden behind the decoders, so this code runs automatically on any `require('hardhat-zet')` and its behavior is not observable without deobfuscation. Publisher metadata (author 'Robert King <[email protected]>', bugs URL https://jsonspack.com/issues) ties to neither the Hardhat nor the pino identity. The combination — ecosystem-typosquat name targeting crypto/Hardhat developers, cover-story README lifted from an unrelated popular package, no-op public API, and a multi-megabyte obfuscated payload auto-executed on import — is the shape of a supply-chain stealer aimed at Ethereum developers.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/501714751ba269514a0a7215c211de39b4230b65/osv/malicious/npm/hardhat-zet/MAL-2026-17234.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/501714751ba269514a0a7215c211de39b4230b65/osv/malicious/npm/hardhat-zet/MAL-2026-17234.json
- https://www.npmjs.com/package/hardhat-zet/v/2.0.1
- https://github.com/advisories/GHSA-qqvr-prmw-6pq2

Compromised versions (1)

= 2.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.