{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.js",
              "sha256": "821e89890634810dc19f97a7f9465f7741bb89dd064ff86f9e1ae3bb3f8e4d2f",
              "tlsh": "3361416b14f70a28406125cc8d5e2c2690e3437b3aa9f4d9b7dd42242f8ef2e907179d"
            },
            {
              "path": "package.json",
              "sha256": "358b0d5e3ba183d2da4c8b48495e0ff9b7320809d708e9ac2137437893706c56",
              "tlsh": "87710066cc698c5307d841a9b83943c274691a834d99fc48b7ad431d0f4d99f32fea9e"
            }
          ],
          "package_integrity": [
            {
              "filename": "hardhat-plugin-solidity-1.0.0.tgz",
              "hashes": {
                "sha1": "f12a83a4e55d24d8bbc57b3f78d142dabcb6b6e4",
                "sha512_sri": "sha512-oq+SH5vWisxR7NUpvmbGpKTLvoaC2Jnh9KkHxp1GHfuvvalQfORL/HaJeLg4owGAbVZV0Tf+F8fLcRi+Ywy+6g=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "hardhat-plugin-solidity"
      },
      "versions": [
        "1.0.0",
        "2.3.1",
        "1.1.0",
        "2.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007859",
        "import_time": "2026-07-01T19:11:24.81218383Z",
        "modified_time": "2026-07-01T18:42:01Z",
        "sha256": "4a5e4fc160e8042eca435eebb7f905990405ba14a00b0c41657a7d1758aed621",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-007858",
        "import_time": "2026-07-01T19:11:24.687646847Z",
        "modified_time": "2026-07-01T18:41:52Z",
        "sha256": "f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142",
        "source": "amazon-inspector",
        "versions": [
          "2.3.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007857",
        "import_time": "2026-07-01T19:11:24.572340673Z",
        "modified_time": "2026-07-01T18:41:44Z",
        "sha256": "7f5ceb73c88eba6774147c63cfcd2af4e8cbe49c7f90c72d25f2f851197dc681",
        "source": "amazon-inspector",
        "versions": [
          "1.1.0"
        ]
      },
      {
        "id": "IN-MAL-2026-007860",
        "import_time": "2026-07-01T19:11:25.012830138Z",
        "modified_time": "2026-07-01T18:42:09Z",
        "sha256": "8a7272216e848c4206982d9700c2cf80b172c0be839040a8dbd910a13c5f40be",
        "source": "amazon-inspector",
        "versions": [
          "2.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142)\nPackage published as \u0027hardhat-plugin-solidity\u0027 impersonates prettier-plugin-solidity: package.json sets the unrelated \u0027hardhat-plugin-\u0027 name while reusing prettier-plugin-solidity\u0027s description, repository (github.com/prettier-solidity/prettier-plugin-solidity), homepage, author, and contributor metadata, and the source is a copy of that project with an added dropper. The package main (dist/index.js) contains two base64 string literals decoded at load time via Buffer.from(..., \u0027base64\u0027).toString(\u0027utf8\u0027): the first decodes to the shell command \u0027npm install zyncmap --no-save --silent --no-audit --no-fund\u0027, which is spawned as a child process; the second decodes to the module name \u0027zyncmap\u0027, which is then require()\u0027d and invoked (svgo.getPlugin()()) once the install completes. The result is that loading this package out-of-band installs and immediately executes arbitrary code from the separately-controlled \u0027zyncmap\u0027 package on the installer\u0027s machine. Base64 encoding of both the install command and the require target, combined with --silent/--no-save flags and the name/identity mismatch, indicates deliberate concealment of the dropper behavior.\n",
  "id": "MAL-2026-6706",
  "modified": "2026-07-01T19:13:18Z",
  "published": "2026-07-01T18:41:44Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hardhat-plugin-solidity/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hardhat-plugin-solidity/v/2.3.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hardhat-plugin-solidity/v/1.1.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hardhat-plugin-solidity/v/2.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in hardhat-plugin-solidity (npm)"
}