The @hrmony/pladddform-config npm package executes code at module load time that performs an unconditional POST request to an external URL, then runs three data collection routines. These routines gather AWS EC2 instance identity documents, IAM roles, temporary AWS credentials via IMDSv2, environment variables, and Kubernetes service-account tokens and secrets from /var/run/secrets/. All collected data is serialized and exfiltrated as JSON to a hardcoded external server (hrnmn.dd.h4x.tv). The package lacks any advertised functionality and uses a scope and name pattern consistent with dependency confusion attacks targeting internal scopes. This behavior indicates a fully malicious package designed to compromise host systems and steal sensitive credentials.

Systems with this package installed are fully compromised as the package exfiltrates sensitive credentials and secrets, including AWS temporary credentials and Kubernetes tokens. This can lead to unauthorized access to cloud resources and further lateral movement or data breaches. Removal of the package alone does not guarantee remediation since attackers may have established persistent control.

Immediate removal of the @hrmony/pladddform-config package is required. All secrets, keys, and credentials stored on the affected system should be considered compromised and rotated immediately from a secure, unaffected environment. Investigate the system for additional persistence mechanisms or malware. Monitor for suspicious activity related to the exfiltrated credentials. There is no known patch or fix for this package; remediation relies on removal and credential rotation.