hardhat-set@2.21.0

Analysis

hardhat-set@2.21.0 is a combosquat of the hardhat package that ships a pino-derived logger with an injected command-and-control beacon. On require, it collects the host's hostname, OS, username and platform and exfiltrates them as a multipart file named sysinfo.txt to hxxp://167[.]88[.]167[.]54:8085/upload, while beaconing JSON (userkey 309, host, OS, username) to hxxp://167[.]88[.]167[.]54:8087/api/notify and hxxp://167[.]88[.]167[.]54:8087/api/log. The C2 logic is hidden in a 4MB obfuscated lib/config.js (javascript-obfuscator output with hex-escaped method names). The beacon runs automatically when the package is loaded.