Malicious code in solidity-hold (npm)

The solidity-hold package version 2.0.1 on npm is a malicious package that impersonates the widely used pino logger by copying its branding and source structure. However, it replaces the lib/config.js file with a large, obfuscated JavaScript bundle (~4 MB) that executes immediately upon requiring the package. This obfuscated payload uses techniques such as hex string arrays, control-flow flattening, and a rotating decoder loop to evade detection. The package also includes an axios dependency, which is unnecessary for a logger and may enable network egress. The publisher information is unrelated to the legitimate pino project, confirming the package is a hostile payload carrier designed to deceive and potentially compromise systems that install it.

Any system or developer that installs and requires [email protected] will execute the obfuscated malicious payload embedded in the package. This can lead to unauthorized code execution and potential network communication due to the axios dependency. The impersonation of a trusted package increases the risk of inadvertent installation and exploitation. No known exploits in the wild are reported yet.

Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Until a fix or removal is confirmed, avoid installing or requiring [email protected]. Verify package authenticity before use and prefer official, well-maintained packages. Remove any installations of [email protected] from your environment.