GCVE-110-OSM-2026-13483

The package is published as `hardhat-pack`, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript declarations and library source are copied verbatim from the unrelated `pino` logger. The only material divergence from upstream pino is that `index.js` adds `const config = require('./lib/config');` at the top level, and `lib/config.js` is a single-line 4.4MB obfuscator.io payload: an IIFE with a ~26,000-entry hex-escaped string array and a rotating decoder. Nothing in the shipped source references `config` for a legitimate purpose, and the package carries no native build, no vendored SDK, and no other justification for a multi-megabyte opaque blob. The package also declares `axios` as a runtime dependency, consistent with network exfiltration or remote fetch from inside the decoded payload. Any process that imports `hardhat-pack` hands the opaque payload to the JavaScript engine on first require. ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account