The malicious npm package @hrmony/belegerfassung-pladddform (version 1.99.0) executes exfiltration logic at the top level of its main module. Upon import, it sends a beacon to https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_belegerfassung-pladddform, then queries the AWS EC2 Instance Metadata Service (IMDSv2) to gather AMI ID, instance identity, IAM role names, and security credentials, including short-lived EC2 instance credentials and user-data. It also enumerates all environment variables and recursively reads all files under /var/run/secrets/ (Kubernetes service-account and secret mount point). All collected data is POSTed to the attacker's endpoint. The package name is a typosquat of a legitimate package name and depends on another attacker-controlled package, @hrmony/kit-5, extending the malicious payload delivery surface.

Any system with this package installed is fully compromised, as the attacker gains access to sensitive AWS credentials, environment variables, and Kubernetes secrets. This can lead to unauthorized access to cloud resources, data exfiltration, and further compromise of the environment. Secrets and keys stored on the compromised system should be considered exposed and rotated immediately.

Remove the malicious package immediately. Rotate all secrets and keys that were stored or accessible on the compromised system from a separate, secure environment. Because the package executes malicious code at import, full system compromise is likely, so additional forensic analysis and remediation may be necessary. There is no known patch or official fix; the package should be considered malicious and untrusted.