The @hrmony/mailer-pladddform npm package is malicious. Its index.js runs at top-level import and performs three credential-harvesting flows: (1) it requests an IMDSv2 token from the AWS metadata service and extracts IAM role credentials and EC2 instance identity documents; (2) it enumerates environment variables and reads Kubernetes secrets from /var/run/secrets/; (3) it sends all collected data as JSON to a hardcoded attacker endpoint (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_mailer-pladddform). The package name uses misspellings consistent with typosquatting. It also pulls in additional attacker-controlled code via a same-scope dependency. The package contains no legitimate mailer functionality.

Any system with this package installed or running is considered fully compromised. All secrets and keys stored on the system may have been exfiltrated to an attacker. This includes AWS IAM credentials, EC2 instance identity documents, Kubernetes ServiceAccount tokens, and other mounted secrets. The attacker may have gained persistent control of the system. Simply removing the package does not guarantee removal of all malicious software or attacker access.

Remove the @hrmony/mailer-pladddform package immediately. Rotate all secrets and keys that were stored on the compromised system from a separate, trusted environment. Conduct a thorough investigation for additional malicious software or persistence mechanisms installed by the attacker. Do not rely solely on package removal for remediation.