The @hrmony/pladddform-infrastructure npm package executes top-level code that sends a beacon to an attacker-controlled URL. It uses an IMDSv2 token to query the AWS Instance Metadata Service at 169.254.169.254, enumerates instance and identity metadata, retrieves short-lived IAM role credentials, and exfiltrates this data to the attacker. Additionally, it serializes the entire process environment and reads Kubernetes secrets from /var/run/secrets/, sending this combined sensitive information to the same endpoint. The package also depends on @hrmony/kit-5, which likely introduces further malicious code. The package name and scope are crafted to resemble legitimate internal infrastructure packages, indicating a typosquatting or dependency confusion attack vector.

Sensitive AWS instance metadata, IAM role credentials, environment variables, and Kubernetes secrets can be stolen by an attacker, potentially leading to unauthorized access and control over cloud resources and workloads. This compromises the confidentiality and integrity of the affected environment.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, avoid using or installing the @hrmony/pladddform-infrastructure package and its dependencies. Verify the authenticity of internal packages and audit dependencies for typosquatting or malicious code. Remove any instances of this package from your environment if found.