# MAL-2026-13609: Malicious code in hardhat-set (npm)


- **Type:** Malicious package
- **Package:** `hardhat-set` (npm)
- **Published:** 7 Aug 2026

## What is MAL-2026-13609?

MAL-2026-13609 is a malicious package in hardhat-set, published on 7 Aug 2026. 

### Official description

The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project (github.com/pinojs/pino), while package.json declares author 'Robert King <hello@jsonspack.com>' with bugs URL 'https://jsonspack.com/issues'. index.js executes `const config = require('./lib/config')` at load time; lib/config.js is a 4,060,622-byte single-line file packed with obfuscator.io (23,931-entry rotated string array, RC4/base64 string decoder, control-flow flattening, self-defending checks) and runs a top-level IIFE on require. No other file in the package references config's exports, and pino itself contains no such module. The combination of a name/README mismatch (pino cover story on a package named after Hardhat), an unrelated author domain, and a multi-megabyte obfuscated blob that self-executes on import is a masquerade/typosquat delivering a hidden payload to anyone who installs or requires the package.

## What should I do about MAL-2026-13609?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13609 is a malicious package: hardhat-set (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13609/ (Markdown: https://insights.sbomify.com/MAL-2026-13609/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13609

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13609/
Summaries are generated and may contain mistakes; the official description above is the record.