The malicious code in @hrmony/devtool-configuration (version 1.99.0) performs an unconditional POST request to a remote attacker-controlled domain upon import. It collects sensitive data including AWS EC2 instance identity documents, user-data, network metadata, IAM security credentials (access key, secret key, session token), full environment variables, and Kubernetes secrets from /var/run/secrets/. All collected data is sent to the attacker's server, enabling full system compromise.

Any system with this package installed or running is considered fully compromised. The attacker gains access to all AWS IAM credentials, Kubernetes secrets, and environment variables, potentially allowing unauthorized access to cloud resources and sensitive data. Immediate secret rotation is required as the attacker may have persistent access.

Remove the @hrmony/devtool-configuration package version 1.99.0 immediately. Rotate all AWS IAM credentials, Kubernetes secrets, and any other secrets or keys stored on the compromised system from a secure, unaffected environment. Due to the severity of the compromise, assume full system compromise and consider rebuilding affected systems.