Malicious Code Injection in hardhat-pack: A Security Threat
Summary
MAL-2026-17661: Malicious code in hardhat-pack (npm). Affects hardhat-pack versions 2.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'hardhat-pack' is an npm package that superficially resembles the Hardhat Ethereum tooling ecosystem. It is designed to facilitate development in the Ethereum blockchain space. However, this package has been found to contain malicious code that poses significant security risks to users who import it into their projects.
Vulnerability Detail
The vulnerability originates from the 'hardhat-pack' package, which has been identified as containing malicious code. The package's README, LICENSE, TypeScript declarations, and library source are copied from the unrelated 'pino' logger. The primary divergence is the inclusion of a large obfuscated payload in 'lib/config.js', which is a 4.4MB IIFE containing a hex-escaped string array and a rotating decoder. This payload is executed upon the first require of the package, potentially leading to network exfiltration or remote fetch operations. The presence of 'axios' as a runtime dependency further indicates the risk of data being sent to external servers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hardhat-packIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the 'hardhat-pack' package altogether. Instead, consider using the official Hardhat packages or other well-known alternatives that do not exhibit malicious behavior. Always verify the integrity of packages before including them in your project.
Conclusion
The 'hardhat-pack' package poses a significant security threat due to the presence of malicious code. Users are strongly advised to uninstall this package and replace it with trusted alternatives to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for hardhat-pack →
FAQ
The 'hardhat-pack' package is an npm package that mimics the Hardhat Ethereum tooling ecosystem but contains malicious code.
The malicious code can lead to unauthorized data exfiltration and potentially compromise your application's security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Currently, there is no patched version available for 'hardhat-pack'. It is recommended to uninstall the package immediately.
Uninstall 'hardhat-pack' using 'npm uninstall hardhat-pack' and replace it with a legitimate package that serves your needs.
