Malicious code in hardhat-cap (npm)

The npm package hardhat-cap was identified as a malicious typosquat targeting developers working with Hardhat. The package masqueraded as legitimate by copying the README, LICENSE, and type definitions from the pino logger library, with author metadata pointing to jsonspack.com.

The malicious payload was embedded in lib/config.js, a ~4 MB single-line obfuscated module transformed with obfuscator.io. This module employed multiple obfuscation techniques including a rotated string array of approximately 23,931 entries, dual decoders, RC4+base64 string decoding, and control-flow flattening. The obfuscated code was wrapped in a self-invoking IIFE that executed automatically at load time when the package was required.

When developers installed and imported hardhat-cap, the malicious payload executed unconditionally on their host system, providing arbitrary code execution capabilities to an attacker. The combination of the Hardhat-themed package name, copied pino source code as cover, and the opaque obfuscated third module is consistent with a supply chain attack designed to compromise developer environments.

The incident was identified and credited to the OpenSSF's malicious-packages repository.