The @hrmony/pladddform-partner-registry npm package executes a top-level fetch on import that collects sensitive information from the host environment. It queries the AWS EC2 Instance Metadata Service (IMDSv2) to enumerate IAM role names and retrieve temporary security credentials, instance identity documents, and user-data. It also enumerates all environment variables and recursively reads Kubernetes secrets from /var/run/secrets/. The collected data is serialized as JSON and sent to a hardcoded attacker endpoint (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-partner-registry). The package name is a typo variant under the @hrmony scope and depends on a sibling malicious package, indicating a coordinated typosquatting and dependency confusion attack. The package has no legitimate functionality and its sole effect is credential and secret exfiltration.

Any system with this package installed or running is considered fully compromised. All secrets and keys stored on the compromised system may have been exfiltrated to the attacker. This includes AWS IAM credentials, EC2 instance metadata, Kubernetes service-account tokens, environment variables, and other sensitive files. Immediate secret rotation is required from a secure environment. Removing the package alone does not guarantee removal of all malicious software or attacker persistence.

No official patch or fix is available. The package should be immediately removed from all systems. All secrets and credentials that may have been exposed must be rotated immediately from a different, trusted environment. Due to the high likelihood of full system compromise, a full incident response and forensic analysis is recommended to identify and remediate any additional attacker presence or backdoors.