VYPR
← All malware advisories

npm · Malicious package advisory

Malware

solidity-cat

MAL-2026-18694

Malicious code in solidity-cat (npm)

Details

solidity-cat ships index.js, which is byte-identical to the hardhat-hold payload: an obfuscator.io-style loader built on execSync and axios that fetches and runs a second stage. It is a new name for the hardhat-hold (MAL-2026-14246) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.

Compromised versions (1)

  • 2.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.