Malicious Code Injection in hardhat-lock Package - Critical Vulnerability Detected
Summary
MAL-2026-17233: Malicious code in hardhat-lock (npm). Affects hardhat-lock versions 2.21.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hardhat-lock package is an npm module designed to function as a logger and middleware for Ethereum development. However, it has been found to contain malicious code that compromises the integrity of applications using it. The package masquerades under a name similar to the well-known hardhat tool, which can mislead developers into trusting it. Its primary attributes include logging capabilities, but the actual implementation is deceptive and harmful.
Vulnerability Detail
The vulnerability originates from the hardhat-lock package version 2.21.0, which contains a significant amount of obfuscated code in its lib/config.js file. This file is a large, single-line script that executes immediately upon loading the package, allowing for unrestricted access to the consumer's Node.js environment. The malicious code can manipulate environment variables, access the filesystem, and perform network operations, posing a severe risk to any application that includes this package. The package's deceptive nature and obfuscation techniques make it a supply-chain attack vector, as it impersonates a legitimate package while executing harmful operations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hardhat-lockIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the hardhat-lock package altogether. If you have already integrated it into your application, ensure to audit your code and remove any references to it. Additionally, monitor your application for any unusual behavior that may arise from the malicious code.
Conclusion
The hardhat-lock package has been identified as containing malicious code that poses a significant risk to applications using it. Developers are urged to remove this package and replace it with trusted alternatives. Continuous monitoring of dependencies is essential to maintain application security.
See every vulnerability recorded for hardhat-lock →
FAQ
The hardhat-lock package is an npm module intended for logging and middleware in Ethereum development, but it has been found to contain malicious code.
The vulnerability allows malicious code to execute within your application's Node.js process, potentially compromising sensitive data and system integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Uninstall the hardhat-lock package immediately using npm uninstall hardhat-lock and replace it with a trusted logging library.
Yes, consider using reputable logging libraries such as 'pino' or 'winston' as alternatives for your logging needs.
