MAL-2026-17509 Malicious code in hardhat-roof (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast,...

Malicious code in hardhat-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d908da8470ad86669b080d267b57174ccd77e5fd6ed2c371c430d98e869f2b [email protected] is published under a name resembling the Ethereum development tool 'hardhat' but ships README, type definitions, and docs copied...

MAL-2026-17508 Malicious code in hardhat-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d908da8470ad86669b080d267b57174ccd77e5fd6ed2c371c430d98e869f2b [email protected] is published under a name resembling the Ethereum development tool 'hardhat' but ships README, type definitions, and docs copied...

Malicious code in hardhat-ftp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array...

MAL-2026-17506 Malicious code in hardhat-ftp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array...

Malicious code in hardhat-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1 The package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger keywords...

MAL-2026-17507 Malicious code in hardhat-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1 The package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger keywords...

Malicious Package

Overview hardhat-lock is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview hardhat-zet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview mini-hardhat is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17234 Malicious code in hardhat-zet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc [email protected] is published under a name that impersonates the Hardhat Ethereum tooling ecosystem, but its README, type definitions and docs/ tree...

Malicious code in hardhat-zet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc [email protected] is published under a name that impersonates the Hardhat Ethereum tooling ecosystem, but its README, type definitions and docs/ tree...

MAL-2026-17233 Malicious code in hardhat-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035a099bd6a60e41f1e1cbc1b70f27fecb9bef3f12d54e016d6991b581fc880f The npm package [email protected] publishes itself as a logger/middleware but its identity and contents are inconsistent with that purpose: README...

Malicious code in hardhat-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035a099bd6a60e41f1e1cbc1b70f27fecb9bef3f12d54e016d6991b581fc880f The npm package [email protected] publishes itself as a logger/middleware but its identity and contents are inconsistent with that purpose: README...

MAL-2026-17236 Malicious code in mini-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e [email protected] presents itself as a pino-like JSON logger, but its main entry exports a middleware factory that, on instantiation, spawns...

Malicious code in mini-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e [email protected] presents itself as a pino-like JSON logger, but its main entry exports a middleware factory that, on instantiation, spawns...

Malicious Package

Overview hardhat-devkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview hardhat-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in hardhat-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950 Package presents itself as a pino-compatible logger module.exports.pino = middleware; keywords fast/logger/stream/json but ships an RCE loader...

MAL-2026-16348 Malicious code in hardhat-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65f09d6bfd4d7c28183a13e64a9eb5e989fa7b24fbf92c049a044accefe4950 Package presents itself as a pino-compatible logger module.exports.pino = middleware; keywords fast/logger/stream/json but ships an RCE loader...