The npm package @hrmony/[email protected] and 49.3.0 contains top-level code that executes upon import or require, sending HTTP POST requests to a hardcoded attacker domain (https://hrnmn.dd.h4x.tv). It runs two harvesting functions: aws_get() which queries the AWS EC2 Instance Metadata Service using IMDSv2 to collect instance identity, IAM role names, and temporary security credentials; and local_get() which enumerates environment variables and recursively reads Kubernetes secret files from /var/run/secrets/. Both sets of harvested data are exfiltrated to the attacker endpoint. The package is a dependency confusion typosquat with a misspelled scope and name, mimicking an internal package and including a similarly named dependency, indicating an attempt to trick internal users into installing it.

This malicious package can lead to the compromise of AWS EC2 instance credentials and Kubernetes secrets, potentially allowing attackers to escalate privileges, access sensitive cloud resources, and move laterally within compromised environments. The exfiltration of environment variables and service account tokens poses a significant risk to cloud infrastructure security.

No official patch or remediation is provided. Users should immediately remove and replace any usage of @hrmony/pladddform-frontend versions 48.99.0 and 49.3.0. Verify dependencies to avoid typosquatting packages and audit package sources carefully. Implement strict package name allowlists and use verified internal registries to prevent dependency confusion attacks.