Which versions of hardhat-plugin-solidity are malicious?

The following npm versions of hardhat-plugin-solidity are flagged malicious: 1.0.0, 1.1.0, 2.0.0, 2.3.1. Treat any of these as compromised.

How do I remediate hardhat-plugin-solidity if I installed it?

hardhat-plugin-solidity is a typosquat — you almost certainly intended a legitimately-named package. Remove hardhat-plugin-solidity, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed hardhat-plugin-solidity — how do I know if it already compromised me?

If hardhat-plugin-solidity was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is hardhat-plugin-solidity part of a known attack campaign?

Yes — hardhat-plugin-solidity is associated with the IN-MAL-2026-007859, IN-MAL-2026-007858, IN-MAL-2026-007857, IN-MAL-2026-007860 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find hardhat-plugin-solidity across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hardhat-plugin-solidity (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hardhat-plugin-solidity across your stack and pipelines.

Malicious package

hardhat-plugin-soliditynpm

Malicious code in hardhat-plugin-solidity (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6706

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall hardhat-plugin-solidity

What this malware does

Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while reusing prettier-plugin-solidity's description, repository (github.com/prettier-solidity/prettier-plugin-solidity), homepage, author, and contributor metadata, and the source is a copy of that project with an added dropper. The package main (dist/index.js) contains two base64 string literals decoded at load time via Buffer.from(..., 'base64').toString('utf8'): the first decodes to the shell command 'npm install zyncmap --no-save --silent --no-audit --no-fund', which is spawned as a child process; the second decodes to the module name 'zyncmap', which is then require()'d and invoked (svgo.getPlugin()()) once the install completes. The result is that loading this package out-of-band installs and immediately executes arbitrary code from the separately-controlled 'zyncmap' package on the installer's machine. Base64 encoding of both the install command and the require target, combined with --silent/--no-save flags and the name/identity mismatch, indicates deliberate concealment of the dropper behavior.

Malicious versions

4 flagged

1.0.01.1.02.0.02.3.1

Indicators of compromise (SHA-256)

4a5e4fc160e8042eca435eebb7f905990405ba14a00b0c41657a7d1758aed621

f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142

7f5ceb73c88eba6774147c63cfcd2af4e8cbe49c7f90c72d25f2f851197dc681

8a7272216e848c4206982d9700c2cf80b172c0be839040a8dbd910a13c5f40be

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for hardhat-plugin-solidity (4 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging hardhat-plugin-solidity across your stack and pipelines.
If you installed it — respond
hardhat-plugin-solidity is a typosquat — you almost certainly intended a legitimately-named package. Remove hardhat-plugin-solidity, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If hardhat-plugin-solidity was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks hardhat-plugin-solidity before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. hardhat-plugin-solidity on npm has been identified as a malicious package (versions 1.0.0, 1.1.0, 2.0.0, 2.3.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007859IN-MAL-2026-007858IN-MAL-2026-007857IN-MAL-2026-007860

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks hardhat-plugin-solidity-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring