
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@deth-profiler/hardhat-plugin
Advanced tools
A one line description of the plugin
Hardhat plugin example.
<A longer, one paragraph, description of the plugin>
This plugin will help you with world domination by implementing a simple tic-tac-toe in the terminal.
<A step-by-step guide on how to install the plugin>
npm install <your npm package name> [list of peer dependencies]
Import the plugin in your hardhat.config.js:
require("<your plugin npm package name>");
Or if you are using TypeScript, in your hardhat.config.ts:
import "<your plugin npm package name>";
<The list of all the required Hardhat plugins if there are any>
<A description of each task added by this plugin. If it just overrides internal tasks, this may not be needed>
This plugin creates no additional tasks.
<or>
This plugin adds the example task to Hardhat:
output of `npx hardhat help example`
<A description of each extension to the Hardhat Runtime Environment>
This plugin extends the Hardhat Runtime Environment by adding an example field
whose type is ExampleHardhatRuntimeEnvironmentField.
<A description of each extension to the HardhatConfig or to its fields>
This plugin extends the HardhatUserConfig's ProjectPathsUserConfig object with an optional
newPath field.
This is an example of how to set it:
module.exports = {
paths: {
newPath: "new-path"
}
};
<A description of how to use this plugin. How to use the tasks if there are any, etc.>
There are no additional steps you need to take for this plugin to work.
Install it and access ethers through the Hardhat Runtime Environment anywhere you need it (tasks, scripts, tests, etc).
FAQs
Hardhat TypeScript plugin boilerplate
We found that @deth-profiler/hardhat-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.