
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
hardhat-packager
Advanced tools
Hardhat plugin for preparing the contract artifacts and the TypeChain bindings for registry deployment
Hardhat plugin for preparing the contract artifacts and the TypeChain bindings for registry deployment.
This plugin builds on top the TypeChain plugin to prepare the contract artifacts and TypeChain bindings for being deployed to a package registry (e.g. npmjs.org). More specifically, it deletes all artifacts and bindings that are not in an allowlist of contracts, minifying the directory structure in the process.
First, install the plugin and its peer dependencies. If you are using Ethers or Waffle, run:
yarn add --dev hardhat-packager typechain @typechain/hardhat @typechain/ethers-v5
Or if you are using Truffle, run:
yarn add --dev hardhat-packager typechain @typechain/hardhat @typechain/truffle-v5
Second, import the plugin in your hardhat.config.js:
require("@typechain/hardhat");
require("hardhat-packager");
Or, if you are using TypeScript, in your hardhat.config.ts:
import "@typechain/hardhat";
import "hardhat-packager";
This plugin adds the prepare-package task to Hardhat:
Prepares the contract artifacts and the TypeChain bindings for registry deployment
This plugin does not extend the Hardhat Runtime Environment.
This plugin extends the HardhatUserConfig object with an optional packager object. This object contains one field,
contracts. This is an array of strings that represent the names of the smart contracts in your project. The plugin
uses this array as an allowlist for the artifacts and the bindings that should be kept for registry deployment.
An example for how to set it:
module.exports = {
packager: {
// What contracts to keep the artifacts and the bindings for.
contracts: ["MyToken", "ERC20"],
// Whether to include the TypeChain factories or not.
// If this is enabled, you need to compile the TypeChain files with the TypeScript compiler before shipping to the registry.
includeFactories: true,
},
};
To use this plugin you need to decide which contracts you would like to be part of the package deployed to the registry. Refer to the configuration section above.
Then run this:
yarn hardhat prepare-package
And go look what you got in the artifacts and the typechain directory.
/artifacts, /contracts and /typechain globs to the
files field in your package.json file.MIT © Paul Razvan Berg
[1.4.2] - 2022-07-26
CHANGELOG.md (@paulrberg)FAQs
Hardhat plugin for preparing the contract artifacts and the TypeChain bindings for registry deployment
The npm package hardhat-packager receives a total of 335 weekly downloads. As such, hardhat-packager popularity was classified as not popular.
We found that hardhat-packager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.