🛡️ MAL-2026-13609 — hardhat-set

Malicious code in hardhat-set (npm)

Source: amazon-inspector

The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project (github.com/pinojs/pino), while package.json declares author 'Robert King <[email protected]>' with bugs URL 'https://jsonspack.com/issues'. index.js executes const config = require('./lib/config') at load time; lib/config.js is a 4,060,622-byte single-line file packed with obfuscator.io (23,931-entry rotated string array, RC4/base64 string decoder, control-flow flattening, self-defending checks) and runs a top-level IIFE on require. No other file in the package references config's exports, and pino itself contains no such module. The combination of a name/README mismatch (pino cover story on a package named after Hardhat), an unrelated author domain, and a multi-megabyte obfuscated blob that self-executes on import is a masquerade/typosquat delivering a hidden payload to anyone who installs or requires the package.