Malicious code in @hrmony/kit-5 (npm)
The npm package @hrmony/kit-5 versions 1.0.0 and 1.0.1 contain malicious code that harvests sensitive AWS and Kubernetes credentials. Both the preinstall script and the main module query the EC2 Instance Metadata Service for IAM credentials, enumerate environment variables, and read Kubernetes secrets, sending this data to an attacker-controlled server. This behavior triggers automatically during installation and when the package is imported or required, potentially exposing cloud and cluster resources to unauthorized access.
AI Analysis
Technical Summary
The @hrmony/kit-5 npm package versions 1.0.0 and 1.0.1 include malicious code embedded in the preinstall lifecycle script and the main entry point (index.js). These components perform identical credential-harvesting activities by querying the EC2 Instance Metadata Service (IMDSv2) at 169.254.169.254 to retrieve the instance identity document and IAM role security credentials. Additionally, they enumerate all environment variables and recursively read Kubernetes service-account tokens and mounted secrets from /var/run/secrets/. The harvested data, including temporary AWS IAM credentials, cloud instance identity, environment variables (which may contain API keys, tokens, and database credentials), and Kubernetes tokens, is exfiltrated via HTTP POST requests to a hardcoded attacker-controlled domain (hrnmn.dd.h4x.tv) at specific endpoints. This malicious activity occurs automatically on npm install and on any require() or import of the package, without user configuration or consent, enabling immediate cross-service access to the victim's cloud and Kubernetes resources.
Potential Impact
The malicious code enables attackers to steal sensitive credentials and tokens from the victim's cloud environment and Kubernetes cluster. This can lead to unauthorized access and control over cloud services and Kubernetes workloads, potentially resulting in data breaches, resource misuse, and further compromise of the victim's infrastructure. The automatic execution during installation and import increases the risk of widespread credential exposure.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using the @hrmony/kit-5 package versions 1.0.0 and 1.0.1. Investigate any deployments or environments where these versions were installed for potential credential compromise. Rotate all exposed AWS IAM credentials, Kubernetes service-account tokens, and any other secrets that may have been exposed. Monitor for suspicious activity in cloud and Kubernetes environments. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Malicious code in @hrmony/kit-5 (npm)
Description
The npm package @hrmony/kit-5 versions 1.0.0 and 1.0.1 contain malicious code that harvests sensitive AWS and Kubernetes credentials. Both the preinstall script and the main module query the EC2 Instance Metadata Service for IAM credentials, enumerate environment variables, and read Kubernetes secrets, sending this data to an attacker-controlled server. This behavior triggers automatically during installation and when the package is imported or required, potentially exposing cloud and cluster resources to unauthorized access.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @hrmony/kit-5 npm package versions 1.0.0 and 1.0.1 include malicious code embedded in the preinstall lifecycle script and the main entry point (index.js). These components perform identical credential-harvesting activities by querying the EC2 Instance Metadata Service (IMDSv2) at 169.254.169.254 to retrieve the instance identity document and IAM role security credentials. Additionally, they enumerate all environment variables and recursively read Kubernetes service-account tokens and mounted secrets from /var/run/secrets/. The harvested data, including temporary AWS IAM credentials, cloud instance identity, environment variables (which may contain API keys, tokens, and database credentials), and Kubernetes tokens, is exfiltrated via HTTP POST requests to a hardcoded attacker-controlled domain (hrnmn.dd.h4x.tv) at specific endpoints. This malicious activity occurs automatically on npm install and on any require() or import of the package, without user configuration or consent, enabling immediate cross-service access to the victim's cloud and Kubernetes resources.
Potential Impact
The malicious code enables attackers to steal sensitive credentials and tokens from the victim's cloud environment and Kubernetes cluster. This can lead to unauthorized access and control over cloud services and Kubernetes workloads, potentially resulting in data breaches, resource misuse, and further compromise of the victim's infrastructure. The automatic execution during installation and import increases the risk of widespread credential exposure.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using the @hrmony/kit-5 package versions 1.0.0 and 1.0.1. Investigate any deployments or environments where these versions were installed for potential credential compromise. Rotate all exposed AWS IAM credentials, Kubernetes service-account tokens, and any other secrets that may have been exposed. Monitor for suspicious activity in cloud and Kubernetes environments. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-17266
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6abbf1a4c9b3d5d17706d590
Added to database: 09/29/2026, 17:13:08 UTC
Last enriched: 09/29/2026, 17:14:12 UTC
Last updated: 09/29/2026, 18:00:13 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.