Skip to content
Latest alertPremia options vaults on Arbitrum drained of about $400k-$465k via empty option pools and flash loans
0xCERT
Report incident
All advisories
High0xCERT-2026-0235·

Malicious npm packages hardhat-option and hardhat-promised impersonate Hardhat and load a wallet-data stealer

Typosquatted npm packages hardhat-option@2.0.1 and hardhat-promised@2.21.0 run an obfuscated loader on import that beacons to a C2 at 167.88.172.33:8087 and spawns file-upload and browser-wallet LevelDB stealer modules. Remove them and treat affected hosts and keys as compromised.

Vuln-watch · relayed from a public source; see Source & attribution below

Affected chainsEthereum

Summary

Two npm packages whose names target the Ethereum development tool Hardhat, hardhat-promised@2.21.0 (published 2026-10-06) and hardhat-option@2.0.1 (published 2026-10-07 09:12 UTC, removed by npm 15:29 UTC), were reported as malicious in the OpenSSF malicious-packages database (MAL-2026-17662, MAL-2026-17660). Both are copies of the pino logger with an added ~4.5 MB obfuscated lib/config.js that runs as soon as the package is required.

Affected

  • hardhat-option (npm) 2.0.1
  • hardhat-promised (npm) 2.21.0
  • Fixed in: no legitimate version exists; the packages are malicious in their entirety

Impact

According to the reporters' sandbox analysis, on import the payload posts the host name, OS details and username to a hard-coded C2 at http://167.88.172.33:8087/api/log and attempts to spawn three stealer modules described as automatic file upload, LevelDB reading (browser-extension / wallet storage) and a persistent socket connection to the operator. hardhat-promised additionally spawns a hidden, detached node process. Developer machines that installed either package should be treated as compromised, including browser-extension wallets and any keys or seed phrases stored on them. The source does not report confirmed victims or losses.

Recommended actions

  • Search lockfiles, node_modules and CI caches for hardhat-option or hardhat-promised and remove them; use the official hardhat package only
  • Treat any machine that installed them as compromised: rotate deployer/private keys, API and RPC tokens, and move funds from wallets (including browser-extension wallets) used on that host to new keys generated on a clean device
  • Block egress to 167.88.172.33 and alert on requests to http://167.88.172.33:8087/api/log
  • Payload hashes (SHA-256 of lib/config.js): hardhat-option b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c; hardhat-promised 7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb

Source & attribution

This 0xCERT advisory summarises reports in the OpenSSF malicious-packages database via OSV, credited to Amazon Inspector and Eunsoo Kim: https://osv.dev/vulnerability/MAL-2026-17660 and https://osv.dev/vulnerability/MAL-2026-17662. Details may change; refer to the original source for the authoritative record.

References

Indicators of compromise

All IOC feeds →
  • urlhttp://167.88.172.33:8087/api/log

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-10-08 · last updated 2026-10-12

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0235/signed.txt | gpg --verify