{"id":"MAL-2026-18694","kind":"package","aliases":["MAL-2026-18694"],"related":[],"title":"Malicious code in solidity-cat (npm)","description":"solidity-cat ships index.js, which is byte-identical to the hardhat-hold payload: an obfuscator.io-style loader built on execSync and axios that fetches and runs a second stage. It is a new name for the hardhat-hold (MAL-2026-14246) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"solidity-cat","fixed":[],"affected":"= 2.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T00:00:00+00:00","first_seen_at":"2026-11-05T06:31:46+00:00","triaged_at":"2026-11-05T06:32:52+00:00","updated_at":"2026-11-05T06:32:52+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-14246':63C '-18694':10A,13A '-2026':9A,12A,62C 'axio':43C 'built':39C 'byte':27C 'byte-ident':26C 'campaign':64C 'cat':6A,16A,21C 'code':2A,84C 'evid':73C 'execsync':41C 'fetch':45C 'file':66C 'hardhat':32C,59C 'hardhat-hold':31C,58C 'hash':67C 'hold':33C,60C 'ident':28C 'import':87C 'index.js':23C 'instal':89C 'know':93C 'loader':38C 'mal':8A,11A,61C 'malici':1A,17B 'match':69C 'name':55C 'new':54C 'npm':7A 'obfuscator.io':36C 'ordinari':80C 'packag':18B,75C 'payload':34C 'present':76C 'record':71C 'run':47C,85C 'second':49C 'ship':22C 'solid':5A,20C 'solidity':15A 'solidity-cat':4A,14A,19C 'stage':50C 'style':37C 'user':92C 'util':81C 'without':90C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["soliditycat"],"ptokens":["cat","solidity"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-26T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18694","url":"https://osv.dev/vulnerability/MAL-2026-18694","severity":"critical","published_at":"2026-10-26T00:00:00+00:00","modified_at":"2026-11-05T05:15:05+00:00","first_seen_at":"2026-11-05T06:31:46+00:00","fetched_at":"2026-11-05T06:31:46+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}