nomicfoundation.hardhat-solidity@0.9.3 security report

napi-rs auto-generated loader that selects the right prebuilt .node binary for the platform and requires it. Requiring a native addon by path or optional-dependency package is exactly what this generated boilerplate is for and does not execute code from an unexpected external destination.

NAPI_RS_NATIVE_LIBRARY_PATH, NAPI_RS_FORCE_WASI, and NAPI_RS_ENFORCE_VERSION_CHECK are read to influence which binding loads. These are documented napi-rs override flags and are user-set, not attacker-supplied; loading a path the user explicitly set is not exfiltration or remote code execution.

Runs ldd --version to detect musl libc on Linux. This is a standard, hardcoded detection probe used only for choosing the correct prebuilt binary; no user input reaches the command, and no data is sent anywhere.

This file implements the WASI preview2 HTTP interface (outgoing/incoming handlers) on top of globalThis.fetch. Making network requests via fetch is the entire purpose of an HTTP shim; URLs and headers come from the calling WASI component, not from hardcoded exfiltration endpoints. No secrets, env vars, credentials or workspace data are read or sent.

This file implements the browser-side, process-local emulation of TCP/UDP sockets for the @bytecodealliance/preview2-shim WASI/webassembly component runtime. Connections and datagrams are held in JavaScript Maps and never touch the real network, filesystem, child processes, or environment variables; there is no obfuscation, no remote code loading, and no credential access.

Implements WASI preview2 UDP socket shim (bind, connect, send/receive datagrams, buffer/TTL options) on top of node:dgram. This is the entire, expected purpose of @bytecodealliance/preview2-shim; no credential access, exfiltration, obfuscation, or hidden triggers are present.

This is the upstream synckit library (untouched, with original UnTS MIT license header) that bridges async worker threads into a synchronous function using MessageChannel, SharedArrayBuffer and Atomics.wait. It spawns a worker thread only via a caller-supplied createWorker factory with empty execArgv; there is no network access, no filesystem/credential reading, no eval of remote payloads and no hidden or date/host-gated logic. Worker-based sync execution is exactly what synckit is built for (used by preview2-shim within Hardhat's Solidity tooling).

Names like trampolineNN and the resource handle tables are the mechanical output of a WebAssembly component toolchain (jco), not deliberate obfuscation; there are no encoded blobs, no remote downloads, no child-process spawning, and no network calls to any host in this portion. The file is a Solidity parser/lexer binding consistent with the hardhat-solidity extension.

The file requires the module path given as argv[2] and sends the result to the parent process via process.send. This is the extension's ConfigLoader helper, intended to load a Truffle/Hardhat config file on behalf of the extension host; loading a user-specified config path is the file's whole purpose, not exfiltration. The leading IIFE only sets a Sentry debug-id on the error stack (standard bundler instrumentation) and does nothing covert.

The IIFE at the top attaches a Sentry debug ID to the global Error object; this is a standard build-time instrumentation snippet (esbuild/rollup Sentry plugin) used for error source mapping, not data collection or exfiltration.

Uses process.on('message')/process.send IPC with the parent extension host to answer file-belongs, resolve-import, and build-compilation requests. Expected for a child worker of a VS Code extension.

Standard Sentry debug-id injection into the global object for source-map correlation. No data is read or transmitted; it only registers a hash. Normal for bundled extensions built with Sentry tooling.