The @hrmony/api-gateway-service-config npm package (version 0.99.0) includes a top-level await fetch call in its index.js that executes on import. This code obtains an AWS IMDSv2 token from the metadata service at 169.254.169.254, reads IAM security credentials, instance identity, user-data, and network information. It enumerates all environment variables and recursively reads Kubernetes secrets from /var/run/secrets/. All collected data is aggregated into JSON and sent via POST to a hardcoded attacker-controlled URL (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_api-gateway-service-config). The package declares a dependency on an unpublished scoped package @hrmony/kit-5, consistent with a dependency confusion attack targeting internal namespaces. Merely installing and importing this package results in theft of cloud IAM credentials and cluster secrets, effectively compromising the host.

Any system with this package installed or running is fully compromised. The attacker gains access to AWS IAM credentials, Kubernetes service-account tokens, and other sensitive environment and instance metadata. This allows unauthorized access to cloud resources and potentially the entire Kubernetes cluster. Secrets and keys stored on the compromised host must be considered exposed and rotated immediately. The attacker may have persistent control beyond the package itself.

Remove the @hrmony/api-gateway-service-config package immediately from all affected systems. Rotate all AWS IAM credentials, Kubernetes secrets, and any other secrets that may have been exposed, using a separate, uncompromised environment. Because the attacker may have gained full control of the host, consider rebuilding or isolating affected systems. No official patch or fix is available; the package is malicious by design. Avoid installing packages from untrusted or unknown sources, especially those with suspicious or unpublished dependencies.