VYPR
← All malware advisories

npm · Malicious package advisory

Malware

solidity-gas-watcher

MAL-2026-18695

Malicious code in solidity-gas-watcher (npm)

Details

solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof (MAL-2026-17509) and chai-foundry (MAL-2026-13356) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.

Compromised versions (1)

  • 2.21.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.