The @hrmony/benefitverwaltung package (version 1.99.0) includes malicious functionality that, when imported, sends an initial beacon to a hardcoded external endpoint (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_benefitverwaltung). It then performs three data exfiltration steps: (1) querying the AWS Instance Metadata Service v2 (IMDSv2) to obtain instance identity and IAM role credentials, (2) enumerating all environment variables, and (3) recursively reading Kubernetes service-account tokens and secret files from /var/run/secrets/. All collected data is sent to the attacker-controlled domain h4x.tv. The package also declares a runtime dependency on another internal-scope package, likely as a dependency confusion tactic. This behavior indicates a supply chain compromise with full host compromise risk.

Any system with this package installed or running is considered fully compromised. The attacker gains access to AWS credentials, environment variables, and Kubernetes secrets, enabling unauthorized access to cloud resources and sensitive data. Immediate secret and key rotation is required from a trusted environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Remove the @hrmony/benefitverwaltung package version 1.99.0 immediately. Rotate all secrets and credentials that may have been exposed, including AWS keys and Kubernetes tokens, from a secure, uncompromised system. Conduct a thorough investigation for additional persistence mechanisms or malware. Monitor for suspicious outbound connections to domains such as h4x.tv. There is no official patch or fix available; remediation relies on removal and secret rotation.