# MAL-2026-17507: Malicious code in hardhat-jsx (npm)


- **Type:** Malicious package
- **Package:** `hardhat-jsx` (npm)
- **Published:** 4 Oct 2026

## What is MAL-2026-17507?

MAL-2026-17507 is a malicious package in hardhat-jsx, published on 4 Oct 2026. 

### Official description

The package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger (keywords 'fast','logger','stream','json'; shipped docs reference pinojs/pino). The main entry index.js unconditionally requires./lib/config, which is a 4,499,968-byte single-line obfuscator.io artifact — a hex-escaped string array of ~26,234 entries with string-array rotation and control-flow flattening (22,707 decoder-wrapper inlines, 44,499 string-inline changes). A legitimate pino 'config' module is ~1-2KB; a multi-megabyte obfuscated blob auto-loaded by the main entry is a loader/dropper. The surface index.js exports a no-op Express-style middleware whose comment claims it 'triggers a background process', providing a cover story adjacent to the obfuscated require. Loading the package via require/import executes the opaque payload in the installer's process. The name/content mismatch (hardhat-jsx vs. pino impersonation), the stub façade, and the heavily obfuscated auto-loaded module together form a trojan-package shape.

## What should I do about MAL-2026-17507?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17507 is a malicious package: hardhat-jsx (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17507/ (Markdown: https://insights.sbomify.com/MAL-2026-17507/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17507

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17507/
Summaries are generated and may contain mistakes; the official description above is the record.