The malicious npm package @hrmony/pladddform-codegen (version 49.99.0) contains code that, upon module load, sends data to a hardcoded external endpoint (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-codegen). It performs three credential-harvesting flows: (1) querying the AWS instance metadata service (IMDSv2) to enumerate IAM roles and retrieve security credentials, EC2 identity documents, user-data, and network metadata; (2) enumerating all environment variables; and (3) recursively reading Kubernetes projected service-account tokens and mounted secrets from /var/run/secrets/. The collected data is exfiltrated to the attacker’s server. The package name is a typosquat of a legitimate @hrmony scoped package and uses an inflated version number consistent with dependency confusion attacks. It also declares a suspicious internal-looking sibling dependency. This behavior indicates a targeted campaign to compromise systems and steal cloud credentials.

Any system with this package installed is considered fully compromised. The attacker gains access to AWS IAM role credentials, EC2 metadata, environment variables, and Kubernetes secrets, enabling potential unauthorized cloud resource access and control. Secrets and keys stored on the compromised system are exposed and should be considered leaked. The attacker may have persistent control beyond just the package installation, making full remediation challenging.

Immediate removal of the @hrmony/pladddform-codegen package version 49.99.0 is required. All AWS credentials, IAM roles, and Kubernetes secrets accessible from the compromised system must be rotated immediately from a secure, uncompromised environment. Because the attacker may have established persistent control, a full system compromise response and forensic analysis are recommended. There is no official patch or fix; the package itself is malicious. Avoid installing packages with suspicious names or inflated version numbers and verify package authenticity before use.