Hostile 93% javascript Download

hardhat-plugin-solidity 2.3.1

Base64 obfuscated npm install execution

SVG decoy wrapper around staged module loadSilent spawn + decoded module name require chain
SHA-25643fcd4d729b5a76d0d7c4e9d31d7bf8dfc44d0569e26664759ee29a7906ca7fc
URLhttps://registry.npmjs.org/hardhat-plugin-solidity/-/hardhat-plugin-solidity-2.3.1.tgz
MaleculeK(Mc)O₂(CS)H₆(CmDb₁₁F₂Os₄Po₆U)Md₅(BkInPa₇)

Also flagged by osv (MAL-2026-6706: Malicious code in hardhat-plugin-solidity (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.