The 'hardhat-gas-tracker' npm package version 1.0.1 is identified as malicious because it performs unauthorized data exfiltration. Specifically, on module load, it schedules a randomized timeout between 5 and 15 seconds to POST a JSON payload containing os.hostname(), os.userInfo().username, os.homedir(), and a full dump of process.env to a hardcoded Pipedream URL. In Hardhat development environments, process.env often contains sensitive private keys, mnemonics, API tokens, and provider keys. The network call is wrapped in silent try/catch blocks to suppress errors, and the package exposes gas-tracking utilities as a cover. This behavior leaks sensitive secrets to whoever controls the Pipedream endpoint, constituting a malicious backdoor in the package.

Sensitive environment variables including deployment private keys, mnemonics, RPC provider keys, and API tokens can be exfiltrated to an attacker-controlled endpoint. This leakage can lead to compromise of blockchain deployments, unauthorized access to infrastructure, and potential financial loss. The malicious behavior is stealthy due to error suppression and legitimate-appearing utility functions, increasing the risk of unnoticed compromise in development environments using this package.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove 'hardhat-gas-tracker' version 1.0.1 from their projects and avoid using this package. Review environment variables and secrets for potential compromise and rotate any exposed credentials. Monitor for any unauthorized activity related to leaked keys. Consider using trusted package sources and scanning dependencies for malicious behavior before inclusion.