The @hrmony/pladddform-testing npm package contains an unconditional exfiltration payload triggered on module import. It queries the AWS EC2 Instance Metadata Service using IMDSv2 to retrieve the instance identity document, user-data, IAM role names, and temporary security credentials. It also enumerates all environment variables and recursively reads Kubernetes secrets from /var/run/secrets/. The collected data is POSTed to a hardcoded attacker endpoint (https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-testing). A separate beacon confirms successful execution. The package lacks legitimate functionality and is likely a typosquatting or dependency confusion attack targeting internal or similarly named scopes. The affected version is 40.14.3.

Systems with this package installed are fully compromised as the attacker gains access to sensitive AWS credentials, environment variables, and Kubernetes secrets. This can lead to unauthorized access to cloud resources, data breaches, and further lateral movement within the environment. Immediate secret and key rotation is required to mitigate ongoing risk.

Remove the @hrmony/pladddform-testing package immediately from all affected systems. Rotate all secrets and keys that may have been exposed, performing this rotation from a secure, uncompromised system. Due to the potential for full system compromise, consider rebuilding affected hosts to ensure removal of any persistent malicious components. There is no official patch or fix available for this malicious package. Monitor package sources carefully to avoid typosquatting and dependency confusion attacks.