MalwarePublished 29 Sep 2026

@hrmony/belegerfassung-pladddform (npm) · Malicious Code

Affects @hrmony/belegerfassung-pladddformSource GCVE Database

Malicious package : remove @hrmony/belegerfassung-pladddform and rotate any secrets on hosts that installed it.

Data as of 29 Sep 2026, 21:26 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17252

What to do

Remove @hrmony/belegerfassung-pladddform from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@hrmony/belegerfassung-pladddform	Affected =1.99.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @hrmony/belegerfassung-pladddform (version 1.99.0) contains malicious code that executes immediately upon import. It sends a beacon to a hardcoded attacker-controlled endpoint, then collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, and Kubernetes secrets, exfiltrating all this data to the same endpoint. The package uses a typosquatting name resembling a legitimate package and includes a transitive dependency from the same attacker-controlled scope, increasing the attack surface. Systems with this package installed should be considered fully compromised.

Impact

Any system with this package installed is fully compromised, as the attacker gains access to sensitive AWS credentials, environment variables, and Kubernetes secrets. This can lead to unauthorized access to cloud resources, data exfiltration, and further compromise of the environment. Secrets and keys stored on the compromised system should be considered exposed and rotated immediately.

Defensive guidance

Remove the malicious package immediately. Rotate all secrets and keys that were stored or accessible on the compromised system from a separate, secure environment. Because the package executes malicious code at import, full system compromise is likely, so additional forensic analysis and remediation may be necessary. There is no known patch or official fix; the package should be considered malicious and untrusted.

Summary

The malicious npm package @hrmony/belegerfassung-pladddform (version 1.99.0) executes exfiltration logic at the top level of its main module. Upon import, it sends a beacon to https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_belegerfassung-pladddform, then queries the AWS EC2 Instance Metadata Service (IMDSv2) to gather AMI ID, instance identity, IAM role names, and security credentials, including short-lived EC2 instance credentials and user-data. It also enumerates all environment variables and recursively reads all files under /var/run/secrets/ (Kubernetes service-account and secret mount point). All collected data is POSTed to the attacker's endpoint. The package name is a typosquat of a legitimate package name and depends on another attacker-controlled package, @hrmony/kit-5, extending the malicious payload delivery surface.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Sep 2026, 21:26 UTC

Technical details

References

Community reviews