hardhat-base

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950)
Package presents itself as a pino-compatible logger (module.exports.pino = middleware; keywords fast/logger/stream/json) but ships an RCE loader. index.js spawns lib/caller.js as a detached child process on middleware invocation. caller.js reads a base64-encoded URL from a fake process.env-shaped constant (DEV_API_KEY), decodes it via atob to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5, POSTs to that endpoint via axios, and passes the response body to new Function.constructor("require", s) — invoking the returned handler with the real require function. Any consumer that requires this package and calls the exported middleware fetches and executes arbitrary attacker-controlled JavaScript with full Node.js require access. The base64 concealment of the endpoint inside fake env-var constants, the detached child spawn, the cover-story pino API surface, and the mismatch with the manifest description (vulnerability-management text) confirm intentional supply-chain attack rather than an insecure update mechanism.

Compromised versions (2)

• 2.2.2
• 2.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.