The hardhat-test-log package (versions 1.1.0 and 1.1.2) masquerades as a known Hardhat gas reporter by copying metadata and author information. Its main reporter function is a decoy; the actual code path always triggers a function that spawns a detached child process running 'lib/syncResolve.js'. This script fetches JavaScript code from a mutable public paste site and executes it dynamically with Node.js require privileges, allowing arbitrary code execution. The payload source is uncontrolled and can be changed at any time by the attacker, making this a persistent and flexible remote code execution backdoor triggered by installing or using the package in Hardhat/Mocha environments.

Installing or using the affected versions of hardhat-test-log results in remote code execution on the host machine. The attacker can execute arbitrary Node.js code with full module access, potentially compromising developer or CI environments. The malicious payload is fetched dynamically from a public, mutable source, enabling ongoing attacker control and evasion of detection.

No official patch or remediation is currently documented. Users should immediately avoid installing or using the hardhat-test-log package versions 1.1.0 and 1.1.2. Verify dependencies to ensure this malicious package is not present. Consider removing it if found. Monitor vendor advisories or trusted security sources for updates or official fixes. Since this is a malicious package impersonating legitimate tools, prefer installing only from verified and official package sources.