The @hrmony/pladddform-application npm package (version 2.99.0) contains embedded malicious code that, when the package is loaded, performs three exfiltration routines. First, it sends a JSON confirmation beacon to a hardcoded URL. Second, it accesses the AWS EC2 Instance Metadata Service (IMDSv2) to retrieve IAM role credentials, instance identity documents, user data, and network interface information, then posts this data to the attacker’s server. Third, it enumerates all environment variables and recursively reads all files under /var/run/secrets/ (including Kubernetes service-account tokens and mounted secrets), sending this combined data to the same attacker endpoint. The package metadata suggests it is a dependency confusion payload targeting internal package names. Any import or require of this package on a host with AWS IMDS or Kubernetes secret mounts results in exfiltration of sensitive credentials and secrets.

Systems with this package installed are fully compromised as attacker-controlled code exfiltrates AWS IAM temporary credentials, environment variables, and Kubernetes secrets. This can lead to unauthorized access to cloud resources, lateral movement, and further compromise of infrastructure. The presence of this package on a host implies that all secrets and keys stored on that host should be considered exposed and rotated immediately.

Remove the @hrmony/pladddform-application package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored on the compromised hosts from a secure, unaffected environment. Due to the full compromise risk, assume the system is untrusted and consider rebuilding or thoroughly investigating for additional persistence mechanisms. No official patch or fix is available; remediation relies on removal and secret rotation.