Hostile 100% javascript Download

hardhat-plugin-solidity 1.0.0

Base64 obfuscated malicious install command

SVG decoy wrapper around staged module loadSilent spawn + decoded module name require chain
SHA-256df0181a2b1b4add9188e41d07575b21527332455347805f9a4f043d196774de0
URLhttps://registry.npmjs.org/hardhat-plugin-solidity/-/hardhat-plugin-solidity-1.0.0.tgz
MaleculeK(Mc)O₂(CS)H₆(CmDb₁₁F₂Os₄Po₆U)Md₅(BkInPa₇)

Also flagged by osv (MAL-2026-6706: Malicious code in hardhat-plugin-solidity (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.