Malicious code in solidity-cat (npm)
MAL-2026-18694
Published · Modified
Dependency scanning
Check whether solidity-cat is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
solidity-cat ships index.js, which is byte-identical to the hardhat-hold payload: an obfuscator.io-style loader built on execSync and axios that fetches and runs a second stage. It is a new name for the hardhat-hold (MAL-2026-14246) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes