Malicious code in hardhat-hold (npm)

The hardhat-hold npm package is a malicious typosquatting package that impersonates legitimate software to trick users into installation. Its main entry point requires an obfuscated ~4MB payload that runs immediately, containing code that uses child_process.execSync and axios to execute shell commands and perform HTTP requests. The package metadata and README are crafted to mimic unrelated legitimate projects, increasing the likelihood of accidental use. The malicious payload's presence at import time means any use of the package triggers the malicious behavior. The affected versions are exactly 2.0.1 and 2.21.0.

Users who install and import hardhat-hold versions 2.0.1 or 2.21.0 risk executing arbitrary shell commands and outbound network requests controlled by an attacker. This can lead to system compromise, data exfiltration, or further malware deployment. The package's typosquatting nature increases the risk of accidental installation by developers intending to use the legitimate hardhat package or pino logger.

No official patch or remediation guidance is provided. Users should avoid installing or using the hardhat-hold package, especially versions 2.0.1 and 2.21.0. Verify package names carefully before installation to avoid typosquatting traps. Consider using package integrity verification tools and monitoring for suspicious dependencies in projects.