hardhat-test-log@1.1.0

Analysis

When loaded as a Mocha reporter, this package spawns a hidden detached Node.js child process (lib/syncResolve.js) that fetches a second-stage payload from `hxxps://www[.]jsonkeeper[.]com/b/NB36A` and executes it via the Function constructor with full access to the Node.js require system. The package is a trojanized clone of the legitimate eth-gas-reporter: its main entry point contains a dead-code guard (`var opt = 1`) that bypasses the real reporter logic and triggers the downloader instead. The attacker-controlled JSONkeeper URL delivers arbitrary remote code. IOCs: C2 URL `hxxps://www[.]jsonkeeper[.]com/b/NB36A`, HTTP header `x-secret-key: _`, max 5 retries on failure.