The '@hrmony/pladddform-cli' npm package (version 40.14.3) includes malicious code that, when required or imported, performs three key attacker-benefiting actions targeting a hardcoded external endpoint (https://hrnmn.dd.h4x.tv/). First, it sends an unconditional install/import beacon. Second, it accesses the AWS EC2 Instance Metadata Service (IMDSv2) to enumerate IAM roles and retrieve temporary AWS credentials, user-data, and instance identity documents, then exfiltrates this data. Third, it enumerates environment variables and recursively reads Kubernetes secrets from /var/run/secrets/, sending all collected information to the same endpoint. The exfiltrated credentials and secrets enable immediate takeover of cloud accounts and Kubernetes clusters. The package name mimics a legitimate package name with letter alterations consistent with typosquatting, increasing the likelihood of inadvertent installation.

Systems with this package installed are fully compromised. The attacker gains access to sensitive AWS IAM credentials, instance metadata, environment variables, and Kubernetes secrets, enabling full cloud account and cluster takeover. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. The presence of this package indicates a severe breach of system integrity and confidentiality.

Remove the '@hrmony/pladddform-cli' package immediately from all affected systems. Rotate all exposed AWS credentials, Kubernetes secrets, and any other sensitive keys or tokens from a secure, uncompromised environment. Treat any system with this package installed as fully compromised and conduct a thorough incident response. There is no indication of an official patch or fix; remediation relies on removal and credential rotation.