The @hrmony/cdk-constructs npm package executes top-level asynchronous code on import that collects sensitive data from the host environment. This includes AWS EC2 instance metadata via IMDSv2, IAM role security credentials, environment variables, and Kubernetes service account tokens and secrets. The collected data is serialized and sent as JSON to a hardcoded external endpoint controlled by the attacker. The package name is a deliberate typo of the legitimate @harmony scope, indicating a typosquatting attack. It also declares a runtime dependency on another attacker-controlled package, @hrmony/kit-5, which is installed alongside it. This behavior results in full compromise of any system running this package.

Any system with this package installed is fully compromised, as the attacker gains access to sensitive AWS credentials, environment variables, and Kubernetes secrets. This enables unauthorized access to cloud resources and potentially other systems. The compromise extends beyond the package itself, as the attacker may have deployed additional malicious software. Immediate secret rotation is required to prevent further unauthorized access.

Remove the @hrmony/cdk-constructs package immediately from all affected systems. Rotate all AWS IAM credentials, environment secrets, and Kubernetes tokens from a secure, uncompromised environment. Treat any system that had this package installed as fully compromised and conduct a thorough security review. There is no official patch or fix available; remediation relies on removal and secret rotation.