The @hrmony/gutscheinverwaltung npm package (version 1.99.0) performs unauthorized data exfiltration by fetching AWS EC2 Instance Metadata Service v2 tokens and related identity credentials, enumerating process environment variables, and recursively reading Kubernetes service-account tokens and mounted secret files from /var/run/secrets/. The collected sensitive information is sent to a hardcoded external URL. The package lacks legitimate functionality and is likely a dependency-confusion payload targeting internal @hrmony scoped packages. This behavior indicates a full compromise of any system running this package.

Any system with this package installed is at high risk of full compromise. Sensitive AWS credentials, Kubernetes secrets, and environment variables are exposed and exfiltrated to an attacker-controlled endpoint. This can lead to unauthorized access to cloud resources, containerized environments, and other sensitive infrastructure. The presence of this package implies that all secrets and keys on the affected system should be considered compromised and rotated immediately.

Remove the @hrmony/gutscheinverwaltung package immediately from all affected systems. Rotate all secrets, keys, and credentials that may have been exposed, using a secure and uncompromised environment. Because the package grants full control to an attacker, assume the system is compromised and perform a thorough incident response and forensic analysis. There is no known patch or official fix; remediation relies on removal and secret rotation.