hardhat-plugin-solidity @2.3.1

Summary

Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while reusing prettier-plugin-solidity's description, repository (github.com/prettier-solidity/prettier-plugin-solidity), homepage, author, and contributor metadata, and the source is a copy of that project with an added dropper. The package main (dist/index.js) contains two base64 string literals decoded at load time via Buffer.from(..., 'base64').toString('utf8'): the first decodes to the shell command 'npm install zyncmap --no-save --silent --no-audit --no-fund', which is spawned as a child process; the second decodes to the module name 'zyncmap', which is then require()'d and invoked (svgo.getPlugin()()) once the install completes. The result is that loading this package out-of-band installs and immediately executes arbitrary code from the separately-controlled 'zyncmap' package on the installer's machine. Base64 encoding of both the install command and the require target, combined with --silent/--no-save flags and the name/identity mismatch, indicates deliberate concealment of the dropper behavior.

Source: amazon-inspector (f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142)