The @hrmony/interfaces npm package (version 0.99.0) executes asynchronous code at the top level when imported or required. This code obtains an AWS IMDSv2 token and fetches EC2 instance identity and IAM role temporary security credentials from the instance metadata service. It also serializes the full environment variables and recursively reads Kubernetes secrets from /var/run/secrets/. The aggregated data is sent via POST to a hardcoded external endpoint. The exfiltrated IAM credentials allow AWS API access with the privileges of the host's role, while environment variables and Kubernetes tokens can grant access to CI, build, and cluster resources. The package is small (~5KB) with an empty description and appears to be part of a dependency confusion campaign.

Installation or use of this package results in full compromise of the host system. Sensitive credentials and secrets are exfiltrated to an attacker-controlled server, enabling unauthorized AWS API access and potential control over Kubernetes clusters and CI/build environments. The attacker gains persistent access through stolen credentials, and removing the package alone does not guarantee removal of all malicious artifacts.

Immediate removal of the @hrmony/interfaces package is required. All secrets, keys, and credentials stored on the compromised system must be rotated from a secure, unaffected environment. Due to the high likelihood of full system compromise, further forensic analysis and remediation may be necessary. No official patch or fix is available; mitigation relies on removal and credential rotation.