{"answers":{"affected":"1 open source package ship an affected version, including hardhat-option.","exploited":"There is no known exploitation of MAL-2026-17660 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17660 is a malicious package in hardhat-option, published on 8 Oct 2026."},"fix_prompt":"MAL-2026-17660 is a malicious package: hardhat-option (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17660/ (Markdown: https://insights.sbomify.com/MAL-2026-17660/index.md)","id":"MAL-2026-17660","markdown":"https://insights.sbomify.com/MAL-2026-17660/index.md","name":"MAL-2026-17660","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"hardhat-option@2.0.1 was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like hardhat-promised@2.21.0 (published the day before), the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger (README badges still point to pino) with one file added that pino does not contain: lib/config.js, a 4,499,968-byte obfuscated script. index.js requires ./lib/config on line 6, so the payload runs as soon as the package is required. package.json carries the same fake author as hardhat-promised (Robert King \u003chello@jsonspack.com\u003e), no repository, and the added dependency axios.\n\nBehavior observed when lib/config.js is loaded in an instrumented sandbox: axios.post of JSON to http://167.88.172.33:8087/api/log containing os.hostname(), os.platform()/release()/type() and os.userInfo().username, with a fixed key ukey=309 (hardhat-promised uses 301), a tag t=3, a timestamp and a SHA-256 'validation' header. The messages posted are 'Failed to spawn autoUploadScript', 'Failed to spawn ldbScript' and 'Failed to spawn socketScript', which name the same three stealer modules as hardhat-promised: automatic file upload, LevelDB (browser extension / wallet storage) reading, and a persistent socket connection to the operator.\n\nTrigger: on import (require). Type: trojanized copy of a popular library acting as an information-stealer loader with a hard-coded C2 at 167.88.172.33:8087; second package of the hardhat-promised family.\n\nThe package's declared main index.js immediately requires./lib/config, which is a single-line ~4.5MB obfuscator.io-style bundle (26,234-entry hex-escaped string array, rotated decoder wrappers, control-flow flattening) whose top-level IIFE executes as soon as the module is loaded. The exported middleware is a no-op, so the sole effect of require('hardhat-option') is to run the opaque payload with the installer's privileges. The package also presents a false identity: the name is hardhat-option but README, index.d.ts and lib/* are copied from pinojs/pino and index.js re-exports module.exports.pino = middleware to satisfy consumers expecting pino's API, while package.json attributes authorship to 'Robert King \u003chello@jsonspack.com\u003e' with an unrelated bugs URL at jsonspack.com. A multi-megabyte, fully obfuscated module body that auto-executes on import inside a package falsely wrapped in another project's identity is the canonical loader/dropper shape.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in hardhat-option (npm)","id":"MAL-2026-17660","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"hardhat-option","purl":"pkg:npm/hardhat-option","source":"MAL-2026-17660"}],"products":null,"published":"2026-10-08","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17660/"}