MalwarePublished 29 Sep 2026

@hrmony/cdk-constructs (npm) · Malicious Code

Affects @hrmony/cdk-constructsSource GCVE Database

Malicious package : remove @hrmony/cdk-constructs and rotate any secrets on hosts that installed it.

Data as of 29 Sep 2026, 21:25 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17258

What to do

Remove @hrmony/cdk-constructs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@hrmony/cdk-constructs	Affected =5.3.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @hrmony/cdk-constructs contains malicious code that executes immediately upon import or require. It harvests AWS EC2 instance metadata, including IAM role credentials, environment variables, and Kubernetes secrets, then exfiltrates this sensitive information to a hardcoded external server. The package is a typosquatting attempt targeting developers seeking legitimate AWS CDK constructs under the @harmony scope. It also installs an additional attacker-controlled dependency. Systems with this package installed should be considered fully compromised, and all secrets must be rotated immediately.

Impact

Any system with this package installed is fully compromised, as the attacker gains access to sensitive AWS credentials, environment variables, and Kubernetes secrets. This enables unauthorized access to cloud resources and potentially other systems. The compromise extends beyond the package itself, as the attacker may have deployed additional malicious software. Immediate secret rotation is required to prevent further unauthorized access.

Defensive guidance

Remove the @hrmony/cdk-constructs package immediately from all affected systems. Rotate all AWS IAM credentials, environment secrets, and Kubernetes tokens from a secure, uncompromised environment. Treat any system that had this package installed as fully compromised and conduct a thorough security review.

Summary

The @hrmony/cdk-constructs npm package executes top-level asynchronous code on import that collects sensitive data from the host environment. This includes AWS EC2 instance metadata via IMDSv2, IAM role security credentials, environment variables, and Kubernetes service account tokens and secrets. The collected data is serialized and sent as JSON to a hardcoded external endpoint controlled by the attacker. The package name is a deliberate typo of the legitimate @harmony scope, indicating a typosquatting attack. It also declares a runtime dependency on another attacker-controlled package, @hrmony/kit-5, which is installed alongside it. This behavior results in full compromise of any system running this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Sep 2026, 21:25 UTC

Technical details

References

Community reviews