The @hrmony/valuenet npm package (version 1.99.0) includes malicious code that auto-executes on import or require. It queries the AWS Instance Metadata Service (IMDSv2) to harvest instance identity, EC2 credentials, IAM role security credentials, network interface data, and user-data. It enumerates the entire process environment variables and recursively reads Kubernetes secret volumes from /var/run/secrets/. All collected data is sent via POST requests to a hardcoded attacker endpoint at https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_valuenet. This package is part of a dependency confusion probe targeting internal @hrmony scoped packages. The presence of this package indicates a full compromise of the host system.

Any system with @hrmony/valuenet version 1.99.0 installed or running is fully compromised. Sensitive AWS credentials, instance metadata, environment variables, and Kubernetes secrets are exfiltrated to an attacker-controlled server. This can lead to unauthorized access to cloud resources, data breaches, and further lateral movement within the environment. Immediate secret and key rotation is required from a trusted environment.

Remove the @hrmony/valuenet package version 1.99.0 immediately. Consider the host fully compromised and perform a full incident response. Rotate all secrets and keys that may have been exposed, using a different, trusted system. There is no indication of an official patch or fix; therefore, avoid using this package and monitor for any related malicious activity.