MAL-2026-13616 Malicious code in hardhat-cap (npm)

The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger, with author metadata pointing at jsonspack.com. index.js unconditionally does const config = require('./lib/config');, and lib/config.js is a ~4 MB single-line obfuscator.io-transformed module (rotated string array of ~23,931 entries, dual decoders, RC4+base64 string decoding, control-flow flattening) whose top-level IIFE self-invokes at load time. Requiring the package executes this opaque payload on the installer's host at import time; the surrounding pino code is unrelated cover. A logger has no need for a multi-megabyte obfuscated self-decoding blob, and the name/contents mismatch (Hardhat-themed name, pino source, obfuscated third module) is consistent with a typosquat lure that drops arbitrary code execution into consumers on require.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.