The 'hardhat-set' npm package (version 2.21.0) is a malicious typosquatting package that impersonates the Hardhat project but includes copied documentation from the unrelated pino logger project. Its main JavaScript file loads a 4MB obfuscated script using techniques such as string array rotation, RC4/base64 decoding, control-flow flattening, and self-defending checks. This obfuscated code runs immediately on require, delivering a hidden payload. The package author and bug report URLs are unrelated to the legitimate Hardhat project, further indicating malicious intent. No legitimate exports from the obfuscated module are used, confirming the payload is hidden and not part of normal functionality.

Users who install or require 'hardhat-set' version 2.21.0 risk executing a large obfuscated malicious payload that could compromise their environment. The exact impact is not detailed, but the presence of self-executing obfuscated code in a typosquatting package suggests potential for unauthorized code execution, data compromise, or further malware delivery.

There is no information about an available patch or official fix for this package. The best mitigation is to avoid installing or requiring the 'hardhat-set' package, especially version 2.21.0. Users should verify package authenticity before installation and prefer official sources. Monitor package repositories for removal or vendor advisories regarding this malicious package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.