Trojanized Shell Vulnerability in hardhat-deep Package
Summary
MAL-2026-17659: Malicious code in hardhat-deep (npm). Affects hardhat-deep versions 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hardhat-deep package is an npm library designed to integrate with the Hardhat development environment for Ethereum smart contracts. It is intended to provide logging functionalities similar to the popular pino logger. However, the package has been compromised, containing malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability arises from the hardhat-deep@2.0.1 package, which is a trojanized shell. The package mimics the pino logger's source files while introducing a malicious payload in lib/config.js. This file is an obfuscated bundle that executes harmful code when the package is imported or required in a Node.js application. The malicious code is designed to run unconditionally, compromising the security of any application that uses this package. The author of the package is unrelated to the legitimate Hardhat or pino projects, raising further concerns about its authenticity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hardhat-deepIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the hardhat-deep package altogether and utilize the original pino logger or other trusted logging libraries. Ensure that your package-lock.json is monitored for any dependencies that may inadvertently include hardhat-deep.
Conclusion
The hardhat-deep package has been identified as a trojanized shell that poses significant security risks to users. It is essential to remove this package from your projects and monitor your dependencies for any similar vulnerabilities. Utilizing tools like Vulert can help you stay informed about potential threats in your software.
See every vulnerability recorded for hardhat-deep →
FAQ
hardhat-deep is an npm package intended for use with the Hardhat development environment for Ethereum, providing logging functionalities.
The vulnerability allows malicious code to execute within your application's Node.js process, potentially leading to data breaches or unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
Immediately uninstall the hardhat-deep package using npm uninstall hardhat-deep and consider using a trusted alternative for logging.
No, there is no patched version available for hardhat-deep as it is a malicious package. It is recommended to remove it entirely.
