Malicious Code Injection in hardhat-spack Package
Summary
MAL-2026-17560: Malicious code in hardhat-spack (npm). Affects hardhat-spack versions 3.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The hardhat-spack package is a middleware factory designed for use with the Hardhat development environment, primarily aimed at facilitating logging functionalities. It is intended to enhance the development experience by providing a structured way to handle logs. However, this package has been compromised, leading to significant security concerns due to the presence of malicious code that can execute arbitrary JavaScript.
Vulnerability Detail
The vulnerability originates from the hardhat-spack package, which internally masquerades as a logging utility while executing malicious code. It spawns a child process that decodes and executes JavaScript fetched from a disposable URL, exposing the application to potential data breaches and unauthorized access. The malicious code can access the filesystem, network, and child processes, allowing attackers to manipulate the environment and extract sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hardhat-spackIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the hardhat-spack package from your project until a secure version is available. This can be done using the command: 'npm uninstall hardhat-spack'. Additionally, consider using alternative logging packages that do not have known vulnerabilities.
Conclusion
The hardhat-spack package contains a serious vulnerability that allows for the execution of malicious code, posing significant risks to applications that utilize it. It is essential to update the package or remove it until a secure version is available to protect your application from potential threats.
See every vulnerability recorded for hardhat-spack →
FAQ
The vulnerability involves malicious code that executes arbitrary JavaScript, potentially compromising the security of applications using the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, consider removing the package and using alternative solutions until a secure version is released.
The malicious code spawns a child process that fetches and executes JavaScript from a disposable URL, allowing attackers to manipulate the application environment.
The vulnerability was identified by Amazon Inspector, which specializes in detecting security issues in software packages.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
