MAL-2026-16349 Malicious code in hardhat-devkit (npm)

Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README, index.d.ts, and keywords (fast, logger, stream, json) are copied from pinojs/pino, the manifest description references vulnerability management, and the homepage points at jsonspack.com (author [email protected]). The package's index.js unconditionally executes require('./lib/config') on load. lib/config.js is a single-line ~4,070,107-byte JavaScript file heavily obfuscated with obfuscator.io techniques: hex-escaped identifiers and property names (_0xNNNN, \x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74), a self-mutating string-array indexer with an embedded RC4+base64 string decoder (J[v]=J[W]; e+=String.fromCharCode(N.charCodeAt(a)^J[(J[v]+J[W])%256])), control-flow flattening via a while(!![]){try{...}catch{}} dispatcher, and a debugger-defense self-check. This concealed payload runs on any require('hardhat-devkit') or import of the package, targeting an audience (Ethereum developers) whose machines are likely to hold wallet keystores, mnemonics, and deployment keys. The combination of brand impersonation, mismatched cover-story metadata copied from an unrelated legitimate project, and a multi-megabyte obfuscated blob reachable at module load time is the supply-chain dropper shape.