hardhat-base@2.2.0

Analysis

hardhat-base@2.2.0 ships a detached background subprocess (index.js spawns `node lib/caller.js` with detached:true and unref) that fetches remote code and executes it. lib/caller.js decodes base64 constants to build the URL hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/f1f097d93c318c92f0c5, sends a GET with header `x-secret-key: _`, takes the response's `cookie` field, and runs it through the Function constructor with `require` in scope — executing arbitrary attacker-supplied code with full Node module access. The payload retries up to 5 times on failure. The package name impersonates the hardhat Ethereum development framework.