🛡️ MAL-2026-13616 — hardhat-cap

Malicious code in hardhat-cap (npm)

Source: amazon-inspector

The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger, with author metadata pointing at jsonspack.com. index.js unconditionally does const config = require('./lib/config');, and lib/config.js is a ~4 MB single-line obfuscator.io-transformed module (rotated string array of ~23,931 entries, dual decoders, RC4+base64 string decoding, control-flow flattening) whose top-level IIFE self-invokes at load time. Requiring the package executes this opaque payload on the installer's host at import time; the surrounding pino code is unrelated cover. A logger has no need for a multi-megabyte obfuscated self-decoding blob, and the name/contents mismatch (Hardhat-themed name, pino source, obfuscated third module) is consistent with a typosquat lure that drops arbitrary code execution into consumers on require.