hardhat-devkit@2.3.6

Analysis

hardhat-devkit@2.3.6 is a trojanized clone of the pino logging library. The package ships pino's documentation and type definitions verbatim but replaces lib/config.js — which is loaded when the package is required — with a 4MB obfuscated JavaScript payload (custom string-decoder and array-shuffle bootstrap). The entry point index.js additionally imports child_process.spawn and its exported middleware is a stub that triggers a background process. The package name impersonates the hardhat Ethereum development framework. The obfuscated payload's full behaviour is concealed by the obfuscation.