If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof (MAL-2026-17509) and chai-foundry (MAL-2026-13356) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (a00c60b3f0bfdf801d7f7536dde6ad940ab471235b3c05aeff8cabaf475d0d15)
Package 'solidity-gas-watcher' is a disguised payload carrier. The package.json declares name 'solidity-gas-watcher' with a 'vulnerabilities management' description, but the tarball ships files from the unrelated pino logger project (lib/levels.js, lib/proto.js, lib/transport.js, docs/, pino README) as cover content. The declared main (index.js) is a stub Express-style middleware whose only material effect is `const config = require('./lib/config')`, which loads lib/config.js — a 4,373,384-byte single-line obfuscator.io bundle (string array of ~26,185 entries, hex-escaped identifiers, rotated string-array decoder). The payload executes automatically on `require('solidity-gas-watcher')` with no caller action required. The package also declares axios as a runtime dependency, yet no readable source file references it, indicating the HTTP client is reserved for the obfuscated code. The combination of name/content/description mismatch, pino library files used as cover, a stub entry point, a multi-megabyte opaque loader auto-invoked on import, and an unused network-client dependency is the standard shape of an installer-targeting stealer rather than any legitimate functionality.