{"affected":[{"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solidity-gas-watcher/MAL-2026-18695.json"},"package":{"ecosystem":"npm","name":"solidity-gas-watcher","purl":"pkg:npm/solidity-gas-watcher"},"versions":["2.21.0"]}],"credits":[{"contact":["https://cyberxyz.io"],"name":"CyberXYZ","type":"FINDER"}],"database_specific":{"iocs":{"domains":[],"files":[{"digests":{"sha256":"4e6c4e61a7019ab0affe9c2d20e36701b330ec357be205930355bac1464f9316"},"paths":["index.js"]},{"digests":{"sha256":"7e4c6d76f1d845f752e37876a2d3f773996719f33c2d1c282e0a84b04444efeb"},"paths":["lib/config.js"]}],"ips":[],"urls":[]}},"details":"solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof (MAL-2026-17509) and chai-foundry (MAL-2026-13356) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.","id":"MAL-2026-18695","modified":"2026-11-05T05:15:05.976182871Z","published":"2026-10-26T00:00:00Z","references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/solidity-gas-watcher"},{"type":"WEB","url":"https://osv.dev/vulnerability/MAL-2026-17509"}],"schema_version":"1.9.2","summary":"Malicious code in solidity-gas-watcher (npm)"}