hardhat-hold@2.21.0

Analysis

hardhat-hold@2.21.0 is a combosquat package (named to resemble the hardhat Ethereum development tool) that functions as a C2 reconnaissance implant. On require(), the heavily-obfuscated payload in lib/config.js (4MB, javascript-obfuscator output) beacons system information to a remote server at 167[.]88[.]167[.]54:8087 and 167[.]88[.]167[.]54:8085. It POSTs JSON to /api/log and /api/notify containing the hostname, operating system, and username. It also POSTs a multipart file upload to /upload containing a sysinfo.txt file with hostname, OS, username, platform, and timestamp. The package performs sandbox detection via DNS queries before activating its C2 channel.