The @hrmony/benefit-internetzuschuss npm package version 1.99.0 includes malicious functionality that, immediately upon module import, contacts a hardcoded external host (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_benefit-internetzuschuss) to exfiltrate sensitive data. It retrieves an IMDSv2 token from the AWS Instance Metadata Service at 169.254.169.254, then collects instance identity, user-data, network interface details, IAM role security credentials, the full environment variable map, and Kubernetes secrets from /var/run/secrets/. All collected information is sent as JSON to the attacker-controlled endpoint. The package name is deceptive and unrelated to its malicious behavior.

Any system with this package installed is at high risk of full compromise due to credential theft, including AWS IAM credentials and Kubernetes secrets. Attackers can gain unauthorized access to cloud resources and sensitive data. The presence of this package indicates a severe security breach, and all secrets and keys on the affected system should be considered compromised.

There is no official patch or fix available for this malicious package. Immediate removal of the @hrmony/benefit-internetzuschuss package version 1.99.0 is required. All secrets, keys, and credentials stored on the affected system must be rotated immediately from a secure, uncompromised environment. Because the system may be fully compromised, consider rebuilding or isolating the affected host to ensure complete remediation.