Malicious npm packages target Ethereum developers' private keys

Malicious typosquatting npm packages impersonating the Hardhat development environment have been published to steal Ethereum developer secrets—private keys, mnemonics, and config files—by collecting the data via Hardhat runtime hooks, encrypting it with a hardcoded AES key, and exfiltrating it to attacker-controlled endpoints; the campaign comprises 20 packages with over 1,000 downloads and poses a tangible risk of wallet theft and supply-chain compromise.