Malicious Code Injection in hardhat-bits Package
Summary
MAL-2026-17658: Malicious code in hardhat-bits (npm). Affects hardhat-bits versions 2.21.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hardhat-bits package is an npm module designed to work with Hardhat, a popular Ethereum development environment. It is intended to facilitate the development of smart contracts and decentralized applications. However, this package has been compromised, containing malicious code that poses significant security risks to users who install it.
Vulnerability Detail
The vulnerability originates from the hardhat-bits package, which has been found to contain malicious code hidden within an obfuscated file (lib/config.js). This file executes automatically when the package is imported, allowing an attacker to run arbitrary code on the user's system. The malicious code is disguised by copying content from the legitimate pino logger project, creating a misleading appearance. The obfuscation techniques used include a large, shuffled string array and a self-defending IIFE, making it difficult to detect the malicious behavior. The implications of this vulnerability are severe, as it can lead to unauthorized access, data theft, or further exploitation of the user's environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hardhat-bitsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the hardhat-bits package altogether. If you require similar functionality, look for alternative packages that are well-maintained and have a good reputation in the community. Always verify the integrity of packages before installation.
Conclusion
The hardhat-bits package has been compromised with malicious code that executes upon import, posing significant security risks. Users are advised to uninstall the package and seek alternatives. Monitoring tools like Vulert can help keep your projects secure by alerting you to vulnerabilities.
See every vulnerability recorded for hardhat-bits →
FAQ
The hardhat-bits package is an npm module intended for use with Hardhat, a development environment for Ethereum applications.
The malicious code executes automatically when the hardhat-bits package is imported, due to the inclusion of an obfuscated file that runs on import.
Using the hardhat-bits package can lead to unauthorized access, data theft, and potential exploitation of your development environment.
Currently, there is no patched version available for the hardhat-bits package. It is recommended to uninstall it immediately.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
