Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed hardhat-core v1.0.0 from npm during the active period.
- Ecosystems
- Attack vectors
- Affected entities
- hardhat-core · 1.0.0
The malicious package hardhat-core v1.0.0 on npm impersonates the widely-used hardhat Ethereum development tooling package. The package contains no legitimate functionality (index.js exports an empty object) and serves solely as a delivery mechanism for malware.
During npm install, a postinstall lifecycle script is automatically executed. This script base64-decodes the string 'aHR0cDovLzguMjE3Ljc1LjE0NzozMDAwL3BheWxvYWQ=' to reveal the URL http://8.217.75.147:3000/payload, then fetches the payload over unencrypted HTTP and pipes it directly into bash via curl -s | bash. This executes arbitrary shell code fetched from a hardcoded bare IP address with no integrity verification.
The attack exhibits multiple indicators of malicious intent: install-time code execution via curl piped to bash, base64 obfuscation of the command-and-control URL, and a typosquat package name designed to deceive developers. The package was identified as malicious by both Amazon Inspector and the OpenSSF Package Analysis project.
Affected developers should immediately remove hardhat-core from their systems and dependencies, audit any systems where it was installed for compromise, and ensure they are using the legitimate hardhat package instead.
Indicators of compromise
- Packages
- hardhat-core
- IPs
- 8.217.75.147
Remediation
- Remove hardhat-core from all package.json files and lock files immediately
- Audit any systems where hardhat-core v1.0.0 was installed for signs of compromise or unauthorized access
- Review shell history and process logs on affected systems for evidence of the malicious payload execution
- Use the legitimate 'hardhat' package instead of 'hardhat-core'
- Implement package name verification and allowlisting in dependency management to prevent typosquat installation
- Monitor for any suspicious outbound connections to 8.217.75.147:3000 in network logs
Sources
- GitHub Advisory GHSA-6rxh-8gx9-544x · GitHub Advisory Database
Cite this entry
"Malicious code in hardhat-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-hardhat-core-npm-1u0wfe
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting