Supply chain · npm · High

Malicious 'hardhat-devkit' npm Package Targets Crypto Wallets

Threat Engine Auto-Feed · data current as of 2026-09-21

The npm package 'hardhat-devkit' version 2.3.6 contains highly obfuscated malicious code designed to execute upon module load. It impersonates an Ethereum/Hardhat developer toolkit to target users likely to possess cryptocurrency wallet credentials, posing a critical supply-chain risk.

  • Package: npm / hardhat-devkit
  • Affected versions: = 2.3.6
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Crypto / wallet targeting

A malicious version of the 'hardhat-devkit' npm package (v2.3.6) was published. While presenting itself as a developer toolkit with copied metadata from an unrelated legitimate project, its core functionality is a multi-megabyte, heavily obfuscated JavaScript file that executes immediately upon the package being loaded.

How the attack works

This is a supply-chain attack where a seemingly legitimate software package is compromised with malicious code. The attacker publishes a package that, when installed and imported into a project, automatically executes concealed code. This code is designed to run without further user interaction, leveraging the trust placed in package dependencies to gain initial access or perform its intended malicious actions.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem, particularly those involved in Ethereum or Hardhat development.
  • Organizations whose CI/CD pipelines automatically pull the latest or unpinned versions of dependencies.
  • Developers who might install new packages without thorough vetting.

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently update to the malicious version.
  • Lack of package lockfiles (e.g., package-lock.json) that ensure consistent dependency versions.
  • Use of internal package mirrors that might not filter out malicious packages.
  • Environments where developer machines handle cryptocurrency wallet keystores, mnemonics, or deployment keys.

Blast-radius scenarios

  • If installed, the package's obfuscated payload runs, potentially compromising sensitive data like wallet credentials or deployment keys.
  • An attacker could gain unauthorized access to developer environments or associated cryptocurrency assets.
  • The blast radius extends to any system where this specific malicious version of 'hardhat-devkit' is installed and executed.

What to do (defensive)

Detect

  • Scan existing projects for 'hardhat-devkit' version 2.3.6 in `package.json` or `package-lock.json`.
  • Monitor network traffic for unusual outbound connections from development machines or build servers.
  • Implement static application security testing (SAST) tools that can flag highly obfuscated code or suspicious package metadata.

Contain

  • Immediately remove 'hardhat-devkit@2.3.6' from all projects and development environments.
  • Isolate any systems where the malicious package was installed or executed.
  • Block 'hardhat-devkit' version 2.3.6 from being downloaded from internal package registries.

Remediate

  • Review and rotate any cryptocurrency wallet keys, mnemonics, or deployment keys that may have been present on compromised systems.
  • Force all projects to use pinned dependency versions and commit `package-lock.json` files to version control.
  • Educate developers on vetting new packages, especially those with low download counts or suspicious metadata.
  • Implement stricter supply-chain security policies, including dependency integrity checks and automated vulnerability scanning.

Frontier verdict — High

Prioritize immediate removal of 'hardhat-devkit@2.3.6' due to critical severity and direct targeting of cryptocurrency assets.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.