hardhat-cap@2.21.1

Analysis

hardhat-cap@2.21.1 is a trojanized clone of the pino logger. On require, the package loads a 4MB obfuscated payload (lib/config.js) that fingerprints the host (hostname, OS, username, platform) and exfiltrates it to the remote host 167[.]88[.]167[.]54 over HTTP: a JSON beacon to port 8087 at /api/log and /api/notify, and a multipart file upload of sysinfo.txt to port 8085 at /upload. The payload is obfuscated with a javascript-obfuscator string-array decoder so the C2 endpoints are not visible as plaintext.