{"id":"MAL-2026-18695","kind":"package","aliases":["MAL-2026-18695"],"related":[],"title":"Malicious code in solidity-gas-watcher (npm)","description":"solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof (MAL-2026-17509) and chai-foundry (MAL-2026-13356) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"solidity-gas-watcher","fixed":[],"affected":"= 2.21.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T00:00:00+00:00","first_seen_at":"2026-11-05T06:31:46+00:00","triaged_at":"2026-11-05T06:32:52+00:00","updated_at":"2026-11-05T06:32:52+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-13356':71C '-17509':64C '-18695':11A,14A '-2026':10A,13A,63C,70C 'byte':30C 'byte-ident':29C 'campaign':72C 'chai':39C,67C 'chai-foundri':38C,66C 'code':2A,92C 'copi':44C 'dropper':51C 'entri':46C 'evid':81C 'file':74C 'foundri':40C,68C 'gas':6A,17A,23C 'hardhat':35C,60C 'hardhat-roof':34C,59C 'hash':75C 'ident':31C 'import':95C 'index.js':26C 'instal':97C 'know':101C 'lib/config.js':28C 'load':48C 'mal':9A,12A,62C,69C 'malici':1A,19B 'match':77C 'name':56C 'new':55C 'npm':8A 'obfusc':50C 'ordinari':88C 'packag':20B,83C 'payload':41C 'pino':43C 'point':47C 'present':84C 'record':79C 'roof':36C,61C 'run':93C 'ship':25C 'solid':5A,22C 'solidity':16A 'solidity-gas-watch':4A,21C 'solidity-gas-watcher':15A 'user':100C 'util':89C 'watcher':7A,18A,24C 'whose':45C 'without':98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["soliditygaswatcher"],"ptokens":["gas","solidity","watcher"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-26T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18695","url":"https://osv.dev/vulnerability/MAL-2026-18695","severity":"critical","published_at":"2026-10-26T00:00:00+00:00","modified_at":"2026-11-05T05:15:05+00:00","first_seen_at":"2026-11-05T06:31:46+00:00","fetched_at":"2026-11-05T06:31:46+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}