The @hrmony/lohndateien npm package (version 3.99.0) includes code in index.js that runs immediately when the module is loaded. It performs three key malicious actions targeting AWS and Kubernetes environments: (1) sends a POST beacon to a hardcoded external URL to signal installation, (2) queries the AWS instance metadata service using IMDSv2 to retrieve instance identity, user-data, and IAM role credentials, then exfiltrates this data, and (3) collects all environment variables and recursively reads Kubernetes secret files from /var/run/secrets/, sending these to the same remote endpoint. The remote host is unrelated to the legitimate package publisher, indicating a supply-chain or dependency confusion attack. This results in full attacker access to AWS role credentials, environment secrets, and Kubernetes tokens on compromised hosts.

Successful installation and loading of this package on an EC2 instance or Kubernetes workload leads to complete compromise of AWS IAM credentials, environment variables, and Kubernetes secrets. This allows attackers to gain unauthorized access to cloud resources and potentially escalate privileges or move laterally within the environment. The system should be considered fully compromised.

Remove the @hrmony/lohndateien package version 3.99.0 immediately from all affected systems. Rotate all AWS credentials, environment secrets, and Kubernetes tokens that may have been exposed, using a secure and uncompromised environment. Due to the high likelihood of full system compromise, consider rebuilding affected hosts from trusted sources. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for updates.