Malicious code in solidity-gas-watcher (npm)

solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below matc...