The @hrmony/hyper-json-builder npm package (version 1.99.0) includes malicious code in its index.js that executes immediately upon module load. It performs a fetch to a hardcoded URL controlled by an attacker and triggers two credential-harvesting routines. The first collects all environment variables and recursively reads Kubernetes secrets from /var/run/secrets/, then sends this data to the attacker's endpoint. The second obtains an AWS IMDSv2 token, queries EC2 instance metadata for IAM role credentials, and exfiltrates these credentials to the same endpoint. The package's own name is embedded in the exfiltration path, indicating targeted data theft. Additionally, the package.json declares an unpinned dependency under the same scope that is not imported by the shipped code, potentially indicating further malicious intent or supply chain risk.

Systems with this package installed are fully compromised as attackers gain access to environment variables, Kubernetes secrets, and AWS IAM credentials. This can lead to unauthorized access to cloud resources, data breaches, and further lateral movement within affected environments. The presence of this package on a system implies that attackers may have persistent control, and sensitive credentials have been exposed.

Immediate removal of the @hrmony/hyper-json-builder package version 1.99.0 is required. All secrets, environment variables, Kubernetes service-account tokens, and AWS IAM credentials that may have been exposed must be rotated from a secure, uncompromised system. Because the package grants attackers potential full control, a thorough incident response and system integrity verification should be conducted. No official patch or fix is available; remediation relies on removal and credential rotation.