Malicious code in solidity-cat (npm)

solidity-cat ships index.js, which is byte-identical to the hardhat-hold payload: an obfuscator.io-style loader built on execSync and axios that fetches and runs a second stage. It is a new name for the hardhat-hold MAL-2026-14246 campaign; the file hashes below match that record's evidence. The...