The @hrmony/pladddform-core npm package executes malicious code immediately upon import. It queries the AWS instance metadata service (IMDSv2) to retrieve the instance identity document, network interface details, and IAM security credentials including temporary access keys and session tokens. It also enumerates all environment variables and recursively reads Kubernetes secrets from /var/run/secrets/. All collected data is POSTed to a hardcoded attacker-controlled endpoint at https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-core. The package exposes no functional API and is solely intended for credential and secret harvesting. Additionally, it declares a runtime dependency on a sibling scoped package @hrmony/kit-5, which is likely also malicious. The package name mimics a legitimate platform-core package, and the exfiltration domain uses a suspicious h4x.tv domain.

This malicious package can lead to the compromise of AWS instance credentials and Kubernetes secrets, potentially allowing attackers to escalate privileges, access cloud resources, and move laterally within the environment. The immediate exfiltration of sensitive environment variables and secrets poses a significant risk of unauthorized access and data breaches.

No official patch or remediation is currently documented. Users should immediately remove the @hrmony/pladddform-core package and any related packages from their projects and dependency trees. Audit environments for potential credential exposure and rotate any AWS IAM credentials and Kubernetes secrets that may have been compromised. Avoid installing packages from untrusted or suspicious scopes and verify package authenticity before use.