Malicious code in solidity-hold (npm)
The npm package solidity-hold@2.0.1 contains malicious code disguised as the popular pino logger. The package impersonates pino by copying its README and source structure, but replaces lib/config.js with a heavily obfuscated ~4 MB payload that executes automatically on require().
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed solidity-hold@2.0.1
- Ecosystems
- Attack vectors
- Affected entities
- solidity-hold · 2.0.1
The npm package solidity-hold@2.0.1 is a malicious package that impersonates the widely-used pino logger library. The package copies pino's README badges and lib/ directory structure to appear legitimate, but replaces lib/config.js with a ~4 MB obfuscated bundle generated by obfuscator.io.
The obfuscated payload uses control-flow flattening, a rotating while(!![]) decoder IIFE, and a ~23,890-entry string array to conceal its true functionality. Since index.js requires('./lib/config') at the top level, this opaque code executes automatically whenever the package is imported, regardless of whether the advertised middleware export is actually used.
The package declares an axios dependency—unnecessary for a logger—providing network egress capability. Publisher metadata (author Jackson Blau, bugs URL jsonspack.com/issues) is unrelated to the legitimate pino project, indicating this is a typosquatting or impersonation attack designed to trick developers into installing a malicious dependency.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- solidity-hold@2.0.1
Remediation
- Immediately uninstall solidity-hold@2.0.1 from all projects and environments
- Audit npm install logs and dependency trees to identify all systems that may have installed this package
- Review network traffic and system logs from affected machines for suspicious outbound connections
- Rotate any credentials or secrets that may have been exposed on affected systems
- Update package.json to remove solidity-hold and use the legitimate pino logger if a logger is needed
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-pv28-2qrf-2v4m · GitHub Advisory Database
Cite this entry
"Malicious code in solidity-hold (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-solidity-hold-npm-w0irh9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package