The @hrmony/benefit-essenszuschuss npm package version 3.99.0 contains top-level malicious code that executes on module import. It queries the AWS Instance Metadata Service using IMDSv2 tokens to obtain IAM role credentials, serializes the entire environment variables, and recursively reads Kubernetes secret files from /var/run/secrets/. The collected credentials and secrets are sent as JSON to a hardcoded external URL (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_benefit-essenszuschuss). The package name is crafted to resemble an internal HR/benefits utility, consistent with a dependency confusion attack vector. It also declares an unpinned dependency on @hrmony/kit-5 (^1.0.0), which resolves from the public npm registry, potentially increasing attack surface. This behavior effectively compromises the host environment by exposing sensitive cloud and container secrets to an attacker.

Any system with this package installed or running is considered fully compromised. The attacker gains access to AWS IAM credentials, environment variables, and Kubernetes secrets, enabling unauthorized access to cloud resources and containerized environments. This can lead to complete system takeover, data exfiltration, and further lateral movement within the infrastructure. Immediate secret and key rotation is required to mitigate ongoing risk.

Remove the @hrmony/benefit-essenszuschuss package immediately from all affected systems. Assume full compromise of the host environment and rotate all secrets, keys, and credentials from a secure, uncompromised system. Since the package executes malicious code on import, simply removing it may not eliminate all backdoors or persistence mechanisms. Conduct a thorough incident response and forensic analysis to identify and remediate any additional compromise. Monitor for any further suspicious activity related to this package or its dependencies.