The npm package hardhat-lock@2.21.0 is a malicious package that impersonates a legitimate logging/middleware library but contains a large, heavily obfuscated payload that executes immediately upon import. This payload grants attacker-controlled code unrestricted access to environment variables, filesystem, and network within the Node.js process. The package misuses the Ethereum tooling keyword 'hardhat' and copies unrelated project documentation to disguise its true nature.