MAL-2026-13609 Malicious code in hardhat-set (npm)
Malicious package
Published
MAL-2026-13609 is a malicious package: hardhat-set (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13609/ (Markdown: https://insights.sbomify.com/MAL-2026-13609/index.md)
- Package
- hardhat-set
- Registry
- npm
What is MAL-2026-13609?
MAL-2026-13609 is a malicious package in hardhat-set, published on 7 Aug 2026.
Official description
The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project (github.com/pinojs/pino), while package.json declares author 'Robert King <[email protected]>' with bugs URL 'https://jsonspack.com/issues'. index.js executes
const config = require('./lib/config') at load time; lib/config.js is a 4,060,622-byte single-line file packed with obfuscator.io (23,931-entry rotated string array, RC4/base64 string decoder, control-flow flattening, self-defending checks) and runs a top-level IIFE on require. No other file in the package references config's exports, and pino itself contains no such module. The combination of a name/README mismatch (pino cover story on a package named after Hardhat), an unrelated author domain, and a multi-megabyte obfuscated blob that self-executes on import is a masquerade/typosquat delivering a hidden payload to anyone who installs or requires the package.What should I do about MAL-2026-13609?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.