The @hrmony/app-gateway-templates npm package (version 0.0.51) includes a malicious routine in its main index.js file that, upon require/import, performs an AWS IMDSv2 token PUT request to the local metadata service at 169.254.169.254. Using the token, it retrieves instance identity, IAM role security credentials (temporary AWS access key, secret key, and session token), and network metadata. It also enumerates all environment variables and recursively reads /var/run/secrets/, which on Kubernetes pods contains service-account tokens and application secrets. All collected data is exfiltrated via POST requests to a hardcoded attacker endpoint at https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_app-gateway-templates. The package name is a one-character typo of 'harmony' and depends on another attacker-controlled package '@hrmony/kit-5', increasing the attack surface. This behavior effectively compromises the host system and any secrets stored on it.

Any system with this package installed or running is fully compromised. The attacker gains access to AWS instance metadata, IAM credentials, environment variables, and Kubernetes secrets, enabling unauthorized access to cloud resources and sensitive data. This can lead to complete loss of confidentiality and control over the affected system and associated cloud infrastructure.

Remove the @hrmony/app-gateway-templates package immediately from all affected systems. Rotate all AWS credentials, IAM roles, and any other secrets that may have been exposed, using a secure system not affected by this package. Because the package grants full control to an attacker, assume the system is compromised and consider rebuilding or thoroughly investigating for persistence mechanisms. There is no official patch or fix; remediation requires removal and credential rotation.