The 'hardhat-cap' npm package version 2.21.1 is a malicious typosquatting package that masquerades as a legitimate logger by copying pino logger files but includes an unrelated, approximately 4 MB obfuscated JavaScript module. This module uses multiple layers of obfuscation techniques including rotated string arrays, dual decoders, RC4 and base64 decoding, and control-flow flattening. The obfuscated code executes immediately when the package is imported, enabling arbitrary code execution on the host system. The mismatch between the package name, source code, and the obfuscated payload strongly indicates intentional malicious intent to compromise users who install or require this package.

Users who install or require the 'hardhat-cap' package version 2.21.1 risk arbitrary code execution on their systems due to the embedded obfuscated payload that runs at import time. This can lead to system compromise, data theft, or further malware deployment depending on the payload's intent. There are no known exploits in the wild reported yet, but the potential impact is high given the nature of the code execution.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring the 'hardhat-cap' package version 2.21.1. If already installed, remove the package and audit systems for potential compromise. Use verified and trusted package sources and names to avoid typosquatting attacks. Monitor vendor advisories or npm security announcements for any updates or official remediation.