The npm package 'hardhat-set' version 2.21.0 is a malicious typosquatting package masquerading as a legitimate project. It contains a large, heavily obfuscated JavaScript payload that executes immediately upon import. The package's README and documentation are copied from an unrelated project (pino logger), and the author information points to an unrelated domain, indicating deception. This package delivers a hidden payload to users who install or require it.