Hostile 93% javascript Download

hardhat-plugin-solidity 1.1.0

Base64 obfuscated malicious npm install

SVG decoy wrapper around staged module loadSilent spawn + decoded module name require chain
SHA-256484073d653c77932d0936d9dede0d07b84986fd2ed5baecfd7fceb888af32dc8
URLhttps://registry.npmjs.org/hardhat-plugin-solidity/-/hardhat-plugin-solidity-1.1.0.tgz
MaleculeK(Mc)O₂(CS)H₆(CmDb₁₁F₂Os₄Po₆U)Md₅(BkInPa₇)

Also flagged by osv (MAL-2026-6706: Malicious code in hardhat-plugin-solidity (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.