Malicious Code Injection in hardhat-promised Package
Summary
MAL-2026-17662: Malicious code in hardhat-promised (npm). Affects hardhat-promised versions 2.21.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hardhat-promised package is an npm library designed to work with the Hardhat Ethereum development environment. It is intended to simplify the process of managing promises in asynchronous JavaScript code. However, this package has been found to impersonate another popular package, pino, and contains malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from the hardhat-promised package, which impersonates the pino logger by shipping its README, LICENSE, and directory structure while executing a large obfuscated script upon import. This script, which is over 4MB in size, executes on the user's host machine, potentially leading to severe security breaches. The obfuscation makes it difficult to analyze the code, and its execution at the top level means that any consumer of this package unwittingly runs the malicious code, compromising their environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hardhat-promisedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the hardhat-promised package and replace its functionality with the official pino package. You can install it using the command: npm install pino.
Conclusion
The hardhat-promised package contains malicious code that impersonates the pino logger, posing significant security risks to users. It is essential to uninstall this package and replace it with the legitimate pino package to safeguard your application. Regular monitoring for vulnerabilities using tools like Vulert can help maintain your application's security.
See every vulnerability recorded for hardhat-promised →
FAQ
hardhat-promised is an npm package designed to work with the Hardhat Ethereum development environment, simplifying promise management in asynchronous JavaScript.
The vulnerability allows malicious code to execute on your machine, which can lead to data breaches, unauthorized access, and other security issues.
You should uninstall the hardhat-promised package immediately and replace it with the legitimate pino package to ensure your application's security.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities in real-time without requiring code access. You can check your application for vulnerabilities using the Vulert playground.
No, there is no patch available for hardhat-promised as it is a malicious package. The best course of action is to uninstall it and use a legitimate alternative.
