-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0235 ============================================================ Advisory-ID: 0xCERT-2026-0235 Severity: High Published: 2026-10-08T03:38:47.000Z Updated: 2026-10-12T12:43:37.924Z Chains: Ethereum URL: https://www.0xcert.com/advisory/0xCERT-2026-0235 Title: Malicious npm packages hardhat-option and hardhat-promised impersonate Hardhat and load a wallet-data stealer Summary - ------- Typosquatted npm packages hardhat-option@2.0.1 and hardhat-promised@2.21.0 run an obfuscated loader on import that beacons to a C2 at 167.88.172.33:8087 and spawns file-upload and browser-wallet LevelDB stealer modules. Remove them and treat affected hosts and keys as compromised. Details - ------- Summary Two npm packages whose names target the Ethereum development tool Hardhat, hardhat-promised@2.21.0 (published 2026-10-06) and hardhat-option@2.0.1 (published 2026-10-07 09:12 UTC, removed by npm 15:29 UTC), were reported as malicious in the OpenSSF malicious-packages database (MAL-2026-17662, MAL-2026-17660). Both are copies of the pino logger with an added ~4.5 MB obfuscated lib/config.js that runs as soon as the package is required. Affected - - hardhat-option (npm) 2.0.1 - - hardhat-promised (npm) 2.21.0 - - Fixed in: no legitimate version exists; the packages are malicious in their entirety Impact According to the reporters' sandbox analysis, on import the payload posts the host name, OS details and username to a hard-coded C2 at http://167.88.172.33:8087/api/log and attempts to spawn three stealer modules described as automatic file upload, LevelDB reading (browser-extension / wallet storage) and a persistent socket connection to the operator. hardhat-promised additionally spawns a hidden, detached node process. Developer machines that installed either package should be treated as compromised, including browser-extension wallets and any keys or seed phrases stored on them. The source does not report confirmed victims or losses. Recommended actions - - Search lockfiles, node_modules and CI caches for hardhat-option or hardhat-promised and remove them; use the official hardhat package only - - Treat any machine that installed them as compromised: rotate deployer/private keys, API and RPC tokens, and move funds from wallets (including browser-extension wallets) used on that host to new keys generated on a clean device - - Block egress to 167.88.172.33 and alert on requests to http://167.88.172.33:8087/api/log - - Payload hashes (SHA-256 of lib/config.js): hardhat-option b01c59ae0a76527503799aab109bd701e34f260d192722a8cf12c97a4e6d208c; hardhat-promised 7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb Source & attribution This 0xCERT advisory summarises reports in the OpenSSF malicious-packages database via OSV, credited to Amazon Inspector and Eunsoo Kim: https://osv.dev/vulnerability/MAL-2026-17660 and https://osv.dev/vulnerability/MAL-2026-17662. Details may change; refer to the original source for the authoritative record. References - ---------- - - https://osv.dev/vulnerability/MAL-2026-17660 - - https://osv.dev/vulnerability/MAL-2026-17662 - - https://www.npmjs.com/package/hardhat-option/v/2.0.1 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmroI9oJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmcOUcTG9kWh4/jsJapSr7fVFbxygV82fHz98Jyw x7QHixYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAxzAD+P6bfKt2GH1kFLayJ /r3GvXtF1dCS6wAtIPuuuigqR8QBALjby4feF4tQadRiRWKIKpZrteRgYNul csk7qZ9ZUsoM =JKR0 -----END PGP SIGNATURE-----