Malicious Code Vulnerability in solhint-plugin-hyperlane: Potential Data Exfiltration Risk
Summary
MAL-2026-547: Malicious code in solhint-plugin-hyperlane (PyPI). Affects solhint-plugin-hyperlane versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
solhint-plugin-hyperlane is a package available on PyPI that is designed to assist developers in linting Solidity code for smart contracts. It aims to improve code quality and security by providing feedback on potential issues. However, this package has been identified as malicious, containing code that can compromise user data during installation.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as 'GENERIC-questionable-pentest'. The package overrides the install command in setup.py, executing harmful code that can exfiltrate environment variables and other sensitive data during installation. This poses significant risks, including unauthorized access to sensitive information and potential exploitation by attackers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall solhint-plugin-hyperlaneIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the solhint-plugin-hyperlane package until a patched version is confirmed. If you need similar functionality, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The solhint-plugin-hyperlane package has been identified as malicious, posing significant risks to users through potential data exfiltration. It is essential to uninstall the affected version and monitor for updates. Utilizing tools like Vulert can help maintain security in your software dependencies.
See every vulnerability recorded for solhint-plugin-hyperlane →
FAQ
solhint-plugin-hyperlane is a linting tool for Solidity code, helping developers identify potential issues in their smart contracts.
The vulnerability allows malicious code to execute during installation, potentially exfiltrating sensitive data from the user's environment.
If you have installed solhint-plugin-hyperlane, immediately uninstall it and check for any updates or patches before reinstalling.
Yes, consider using other linting tools for Solidity that are known to be secure and do not have reported vulnerabilities.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using Pipfile.lock. You can check your application against known vulnerabilities using the Vulert playground without signing up.
References
Related vulnerabilities
Recent vulnerabilities recorded for solhint-plugin-hyperlane.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
