The @hrmony/account-management npm package (version 1.99.0) includes malicious code that runs immediately when the module is required or imported via a top-level await. It queries the AWS Instance Metadata Service v2 (IMDSv2) at 169.254.169.254 to retrieve instance identity, IAM role temporary credentials, user-data, and network information. Additionally, it enumerates all environment variables and recursively reads Kubernetes-mounted secrets from /var/run/secrets/. The collected sensitive data is then POSTed to a hardcoded attacker-controlled endpoint (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_account-management). The package uses a private-looking scope (@hrmony) and declares an unpinned dependency on @hrmony/kit-5, consistent with a dependency confusion or scope-squatting attack aimed at internal npm scopes. This behavior indicates a supply chain compromise with severe implications for affected systems.

Any system with this package installed or running is considered fully compromised. The attacker gains access to sensitive AWS credentials, environment variables, and Kubernetes secrets, enabling potential unauthorized access and control over cloud resources and workloads. The compromise extends beyond the package itself, as the attacker may have established persistent control over the system. Immediate secret rotation is required to mitigate ongoing risk.

Remove the @hrmony/account-management package version 1.99.0 from all affected systems. Immediately rotate all secrets and keys stored on compromised systems from a separate, trusted environment. Because the attacker may have established persistent control, assume full compromise of affected hosts and conduct a thorough investigation and remediation. No official patch or fix is currently available; remediation relies on removal and secret rotation.