The @hrmony/benefit-mobilitaet npm package (version 1.99.0) includes code that unconditionally accesses the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instance identity, user-data, and all IAM role temporary security credentials from /iam/security-credentials/. It enumerates all environment variables and recursively reads Kubernetes secrets from /var/run/secrets/. The collected sensitive information is sent as JSON to a hardcoded attacker-controlled URL (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_benefit-mobilitaet). The package manifest shows signs of a dependency-confusion attack, including a placeholder author and an internal-scope dependency resembling a legitimate namespace. This results in full system compromise upon installation or execution.

Any system with this package installed or running should be considered fully compromised. The attacker gains access to all IAM role temporary credentials, instance metadata, environment variables, and Kubernetes secrets, enabling unauthorized access and control. Secrets and keys stored on the compromised system must be rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Immediate removal of the @hrmony/benefit-mobilitaet package version 1.99.0 is required. All secrets, keys, and credentials accessible from the compromised system must be rotated from a separate, secure environment. Due to the full compromise risk, a thorough incident response and system integrity verification should be conducted. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates or official fixes.