Security researchers have discovered multiple malicious packages on the npm registry masquerading as the Nomic Foundation’s Hardhat development tool. These packages aim to steal sensitive data from Ethereum developers’ systems.

The counterfeit packages, including variants like @nomisfoundation/hardhat-configure and @nomicfoundation/sdk-test, have garnered significant downloads, with one package reaching over 1,000 installations. These malicious implementations target the Hardhat environment, which is crucial for Ethereum software development, including smart contracts and dApps.

Attack Mechanism:
– Packages harvest mnemonic phrases and private keys upon installation
– Exploit Hardhat runtime environment through hreInit() and hreConfig() functions
– Exfiltrate collected data to attacker-controlled servers using hardcoded keys

This discovery follows recent findings of other malicious packages, including:
– ethereumvulncontracthandler: Disguised as a security tool but deploys Quasar RAT malware
– MisakaNetwork: A blockchain-powered botnet using Ethereum smart contracts for C2 communication

Additional malicious packages were identified across npm, PyPI, and RubyGems platforms, utilizing OAST tools for data exfiltration. These packages target system information and sensitive data through various techniques while avoiding specific geographic locations.

Recommended Security Measures:
– Verify package authenticity
– Double-check package names
– Review source code before installation
– Monitor dependencies carefully

The attacks highlight the growing complexity of npm ecosystem security and the importance of thorough package verification in development environments.