Malicious hardhat-option and hardhat-promised npm packages

Not stated (no confirmed victims reported).

Root cause: Malicious packages, named to target Hardhat users. Per OSV/OpenSSF: index.js requires ./lib/config, which posts host details to a hard-coded C2 at 167.88.172.33:8087 and attempts to spawn file-upload, LevelDB (browser-extension/wallet storage) reading and persistent-socket modules.

Timeline, as sourced: hardhat-promised@2.21.0 published 6 Oct 2026 13:59 UTC; hardhat-option@2.0.1 published 7 Oct 2026 09:12 UTC, removed by npm 15:29 UTC (per OSV).

Two npm packages whose names target users of the Ethereum development tool Hardhat were reported as malicious in the OpenSSF malicious-packages database. According to MAL-2026-17660 (opens in a new tab), hardhat-option@2.0.1 was published on 7 October 2026 at 09:12 UTC and removed by npm at 15:29 UTC. MAL-2026-17662 (opens in a new tab) covers hardhat-promised@2.21.0, published the day before. Both are copies of the pino logger with an added, heavily obfuscated lib/config.js that index.js loads, so the payload runs as soon as the package is required. In sandbox analysis it posted host details to a hard-coded server and tried to start modules for file upload, reading LevelDB browser-extension and wallet storage, and a persistent connection. Neither package is part of Hardhat.