[email protected] is a malicious npm package that impersonates the Hardhat Ethereum tooling ecosystem by using a similar name and copying documentation from the unrelated pino logger project. The package exports a no-op Express middleware but includes a 4.5 MB obfuscated JavaScript bundle that executes automatically when the package is required. This bundle uses string rotation, hex encoding, and control-flow flattening to conceal its behavior and destination URLs. The publisher metadata does not match Hardhat or pino identities, indicating a typosquatting and supply-chain attack targeting Ethereum developers.

The package executes a large obfuscated payload automatically on import, which is not observable without deobfuscation. This behavior suggests it could steal sensitive information or perform malicious actions on developers' systems who install or require this package. The impersonation and obfuscation increase the risk of supply-chain compromise for Ethereum development environments.

No official patch or remediation is indicated. Users should avoid installing or requiring [email protected]. Verify package authenticity before installation, especially for packages related to critical development ecosystems like Ethereum. Use trusted sources and official package names to prevent typosquatting attacks.