The hardhat-test-log package is a malicious npm package that impersonates well-known Hardhat gas reporter packages by copying their metadata and README content. Its main reporter function contains a dead-code gate that always executes a hidden function spawning a detached Node.js child process. This child process fetches JavaScript code from a public paste-style host and executes it dynamically with full Node.js require access, enabling remote code execution. The fetched payload is mutable and unchecked, allowing the attacker to change the code arbitrarily. This malicious behavior activates when the package is installed and used as a Hardhat/Mocha gas reporter, compromising developer or CI environments. Versions =1.1.0 and =1.1.2 are confirmed affected. There is no vendor advisory or patch available at this time.

This vulnerability enables remote code execution on systems that install and run the hardhat-test-log package, including developer machines and continuous integration environments. The attacker gains the ability to execute arbitrary Node.js code with full module access, potentially leading to system compromise, data theft, or further malware deployment. The malicious payload is fetched dynamically from a public, mutable source, allowing ongoing attacker control after installation.

No official patch or remediation is currently available. Users and organizations should immediately stop using the hardhat-test-log package, especially versions =1.1.0 and =1.1.2. Verify dependencies to ensure this package is not included transitively. Replace it with legitimate, verified packages such as eth-gas-reporter or hardhat-gas-reporter. Monitor build and CI environments for unexpected child processes or network connections to unknown hosts. Check vendor advisories for updates on remediation.