Malicious code in hardhat-set (npm)
The npm package hardhat-set contains malicious obfuscated code disguised with a copied pino logger README. The package executes a multi-megabyte obfuscated payload on import, delivering hidden malware to anyone who installs or requires it.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installs or requires the hardhat-set package from npm
- Ecosystems
- Attack vectors
- Affected entities
- hardhat-setnpm package
The npm package hardhat-set is a typosquatting/masquerade attack that mimics the legitimate Hardhat development tool while delivering malicious code. The package's README.md, docs/, and index.d.ts files are copied verbatim from the unrelated pino logger project (github.com/pinojs/pino), creating a false cover story.
The malicious payload is contained in lib/config.js, a 4,060,622-byte single-line file heavily obfuscated using obfuscator.io. The obfuscation includes a 23,931-entry rotated string array, RC4/base64 string decoder, control-flow flattening, and self-defending checks designed to evade analysis.
The package.json declares an author 'Robert King' with a bugs URL pointing to 'jsonspack.com/issues', unrelated to either Hardhat or pino. The index.js file executes const config = require('./lib/config') at load time, triggering the obfuscated code immediately upon import. No legitimate functionality references the config module, confirming it exists solely to deliver the hidden payload.
This combination of name/README mismatch, unrelated author domain, and self-executing obfuscated blob represents a sophisticated supply chain attack targeting developers working with Hardhat or those who might accidentally install the similarly-named package.
Indicators of compromise
- Packages
- hardhat-set
Remediation
- Immediately uninstall hardhat-set from all systems and projects
- Audit npm install logs and package-lock.json files to identify if hardhat-set was ever installed
- Assume any system that installed hardhat-set is compromised; perform security incident response including credential rotation and system forensics
- Use npm audit to check for the presence of hardhat-set in dependency trees
- Report the package to npm security team if not already done
- Verify you are installing the legitimate 'hardhat' package (not 'hardhat-set') from npm
- Consider using package name verification tools and dependency scanning in CI/CD pipelines
Sources
- GitHub Advisory GHSA-38jm-xcq2-8w4r · GitHub Advisory Database
Cite this entry
"Malicious code in hardhat-set (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-hardhat-set-npm-1chvg7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in lodsh-cli (npm)
lodsh-cli, a typosquat of lodash-cli on npm, contained malicious code in its postinstall script that executed arbitrary remote code and exfiltrated system information. The package downloaded a Windows executable and sent platform data to a hardcoded IP address.
npmTyposquattingCompromised package - containedcritical
Malicious code in lodahsjs (npm)
The npm package lodahsjs is a typosquatting attack on 'lodash' that contains malicious code in its postinstall script. Upon installation, it exfiltrates system information to a C2 server and downloads and executes a Windows binary, with capability to bridge WSL environments to compromise the host Windows system.
npmCompromised packageTyposquatting - containedcritical
Malicious code in loadashjs (npm)
loadashjs is a typosquat package on npm containing malicious postinstall code that exfiltrates system information and downloads a Windows PE binary from a hardcoded GitHub release URL. The package masquerades as lodash but provides no legitimate functionality.
npmTyposquattingCompromised package - containedcritical
Malicious code in chalk-core (npm)
chalk-core@1.0.0 is a typosquatting package masquerading as the popular chalk library. It contains malicious postinstall scripts that decode and execute arbitrary binaries on Windows and WSL systems, with command-and-control beaconing to 193.70.34.101:20099.
npmTyposquattingCompromised package