MalwarePublished 7 Aug 2026Updated 28 Sep 2026

hardhat-cap (npm) · Malicious Code

Affects hardhat-capSource GCVE Database

Malicious package : remove hardhat-cap and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13616

What to do

Remove hardhat-cap from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhardhat-cap	Affected =2.21.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'hardhat-cap' version 2.21.1 contains malicious code disguised within an obfuscated module. The package superficially mimics the pino logger but includes a large, heavily obfuscated payload that executes arbitrary code upon import. This behavior is consistent with a typosquatting attack designed to trick users into executing malicious code when requiring the package.

Impact

Users who install or require the 'hardhat-cap' package version 2.21.1 risk arbitrary code execution on their systems due to the embedded obfuscated payload that runs at import time. This can lead to system compromise, data theft, or further malware deployment depending on the payload's intent. There are no known exploits in the wild reported yet, but the potential impact is high given the nature of the code execution.

Defensive guidance

Users should immediately avoid installing or requiring the 'hardhat-cap' package version 2.21.1. If already installed, remove the package and audit systems for potential compromise. Use verified and trusted package sources and names to avoid typosquatting attacks. Monitor vendor advisories or npm security announcements for any updates or official remediation.

Summary

The 'hardhat-cap' npm package version 2.21.1 is a malicious typosquatting package that masquerades as a legitimate logger by copying pino logger files but includes an unrelated, approximately 4 MB obfuscated JavaScript module. This module uses multiple layers of obfuscation techniques including rotated string arrays, dual decoders, RC4 and base64 decoding, and control-flow flattening. The obfuscated code executes immediately when the package is imported, enabling arbitrary code execution on the host system. The mismatch between the package name, source code, and the obfuscated payload strongly indicates intentional malicious intent to compromise users who install or require this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Aug 2026, 15:40 UTC

Technical details

References

Community reviews