The '@hrmony/middlewares' npm package performs unauthorized data exfiltration upon module load. It queries the AWS instance metadata service (IMDSv2) to collect instance identity, region, network interfaces, and IAM role temporary credentials. It also serializes all environment variables and recursively reads Kubernetes service-account secret files. This aggregated sensitive information is sent via POST to a hardcoded external endpoint 'https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_middlewares'. The package provides no legitimate functionality and is solely intended for credential and secret theft. The package name and exfiltration domain mimic the legitimate '@harmony/middlewares' package and its naming pattern to deceive users.

Any system with this package installed or running is considered fully compromised. Attackers gain access to AWS credentials, environment variables, and Kubernetes secrets, enabling unauthorized access and control over cloud resources and potentially the entire host environment. All secrets and keys on the compromised system should be considered exposed and rotated immediately. Removing the package alone may not eliminate all malicious artifacts or backdoors.

Remove the '@hrmony/middlewares' package immediately from all affected systems. Rotate all AWS credentials, environment variables, and Kubernetes secrets that may have been exposed, using a secure and uncompromised environment. Conduct a thorough investigation for additional persistence mechanisms or backdoors, as the system may be fully compromised. There is no official patch or fix since this is a malicious package; prevention involves avoiding installation of this package and verifying package authenticity before use.