{"items":[{"id":"NVI-00011172","kind":"supply_chain_event","title":"Malicious code in hardhat-jsx (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w5cp-x835-j7fg"],"plain_summary":"GitHub lists this malware advisory for hardhat-jsx. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-fbfd25b8b4787c9c4a140f2af608a3fb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-fbfd25b8b4787c9c4a140f2af608a3fb","url":"https://github.com/advisories/GHSA-w5cp-x835-j7fg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w5cp-x835-j7fg","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:24.290Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-fbfd25b8b4787c9c4a140f2af608a3fb"],"technology":"hardhat-jsx","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1)\nThe package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger (keywords 'fast','logger','stream','json'; shipped docs reference pinojs/pino). The main entry index.js unconditionally requires./lib/config, which is a 4,499,968-byte single-line obfuscator.io artifact — a hex-escaped string array of ~26,234 entries with string-array rotation and control-flow flattening (22,707 decoder-wrapper inlines, 44,499 string-inline changes). A legitimate pino 'config' module is ~1-2KB; a multi-megabyte obfuscated blob auto-loaded by the main entry is a loader/dropper. The surface index.js exports a no-op Express-style middleware whose comment claims it 'triggers a background process', providing a cover story adjacent to the obfuscated require. Loading the package via require/import executes the opaque payload in the installer's process. The name/content mismatch (hardhat-jsx vs. pino impersonation), the stub façade, and the heavily obfuscated auto-loaded module together form a trojan-package shape.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/","public_affected_ranges":["= 2.0.1"]}],"null_published_at":"2026-10-31T23:18:22.436Z","source_updated_at":"2026-10-05T00:30:41.000Z","source_disclosed_at":"2026-10-05T00:30:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:24.290Z"}],"next_cursor":null,"snapshot_revision":"42594"}