@hrmony/pladddform-infrastructure (npm) · Malicious Code
Affects @hrmony/pladddform-infrastructureSource GCVE Database
Malicious package : remove @hrmony/pladddform-infrastructure and rotate any secrets on hosts that installed it.
Data as of 29 Sep 2026, 21:04 UTC
Malicious package
Published to npm · OSV MAL-2026-17277
What to do
Remove @hrmony/pladddform-infrastructure from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@hrmony/pladddform-infrastructure | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb) On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-infrastructure (host encodes the package name in the path). An aws_get() routine calls the AWS Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates instance/identity metadata, iterates iam/security-credentials/<role> to retrieve short-lived IAM role credentials, and ships the result to the same attacker host. A local_get() routine serializes the entire process.env and recursively reads /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets), then POSTs the combined blob to the same endpoint. The package also declares a runtime dependency on @hrmony/kit-5 under the same scope, pulling additional code controlled by the same actor into any installer's environment. The package name and scope resemble a legitimate internal-sounding infrastructure package (typosquat/dependency-confusion shape targeting an internal '@harmony/platform-infrastructure'-style name). ## Source: ghsa-malware (fedcb513cf9f7b4f7d6598b35e8076c44199eadc1f143d5f46787b7635e0c30b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.