Malicious code in solidity-map (npm)
MAL-2026-18696
Published · Modified
Dependency scanning
Check whether solidity-map is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
solidity-map ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof (MAL-2026-17509) and chai-foundry (MAL-2026-13356) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes