@hrmony/organisationsverwaltung version 7.99.0 is a malicious npm package that executes credential theft code at the top level of its index.js file. Upon loading, it sends a beacon to a remote server, queries the AWS EC2 Instance Metadata Service (IMDSv2) to retrieve IAM role credentials and identity documents, enumerates all environment variables, and recursively reads all files under /var/run/secrets/, which typically contain Kubernetes service-account tokens and mounted secrets. The collected sensitive data is exfiltrated via POST requests to a hardcoded external endpoint. The package metadata indicates it is a dependency-confusion attack targeting the internal @hrmony namespace. This malicious behavior means any system with this package installed is fully compromised.

Systems that have installed or are running @hrmony/organisationsverwaltung 7.99.0 are at high risk of credential theft and full compromise. AWS IAM credentials, environment variables, and Kubernetes secrets can be stolen and sent to an attacker-controlled server, potentially allowing unauthorized access to cloud resources and internal infrastructure. The presence of this package implies that attackers may have persistent access and control over the affected system.

Remove the @hrmony/organisationsverwaltung package version 7.99.0 immediately from all affected systems. Rotate all AWS credentials, Kubernetes secrets, and any other sensitive keys or tokens that may have been exposed, performing this rotation from a clean, uncompromised environment. Because the package executes malicious code on load, consider the affected systems fully compromised and conduct a thorough incident response and forensic analysis. There is no official patch or fix; removal and secret rotation are the primary mitigations.