A vulnerability in Electron's sandboxed preload script caching allows a compromised renderer process to poison the cache and execute arbitrary code in the preload context on subsequent loads. This affects applications that load untrusted content. Fixed versions have been released, and updating is required as no application-side workarounds exist.
markdown-it versions prior to 15.0.1 and before 14.3.1 have two independent quadratic time complexity paths when the linkify option is enabled. This causes the event loop to be blocked for tens of seconds when processing a few hundred KB of markdown containing many linkifiable tokens, leading to availability degradation. The issue arises from inefficient array rebuilding and repeated regex matching in markdown-it's own code, not in the linkify-it dependency. The vulnerability affects only applications that enable the linkify option, which is off by default.
A vulnerability in js-yaml versions 5.0.0 up to but not including 5.4.1 allows an attacker to cause excessive CPU consumption by exploiting how empty merge source mappings are counted. The maxTotalMergeKeys setting does not count empty mappings, enabling an attacker to craft YAML documents that cause the loader to perform O(N*K) work, leading to prolonged CPU usage. This can result in denial of service due to resource exhaustion. A patch is available that adjusts the counting method to include every merge source mapping as one budget unit.
The npm package 'sk-lib-enc' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by it. Immediate rotation of all secrets and keys from a different, uncompromised computer is strongly recommended.
The npm package @xoxo-momo/kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package @hrmony/hyper-json-builder version 1.99.0 contains malicious code that, upon loading, contacts a hardcoded attacker-controlled endpoint to exfiltrate sensitive information. It harvests environment variables, Kubernetes secrets, and AWS EC2 instance metadata credentials, sending these to the attacker. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately. Removal of the package alone may not eliminate the compromise.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5)
The package's preinstall script and its main entry (index.js) both perform identical credential-harvesting: they query the EC2 Instance Metadata Service (IMDSv2) at 169.254.169.254 for the identity document and IAM role security credentials, enumerate the entire process.env, and recursively read /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets). The collected data is POSTed to a hardcoded attacker-controlled host at hrnmn.dd.h4x.tv (paths /save_instance_info_hook from preinstall and /save_instance_info_index from index.js). The destination is unrelated to any legitimate package purpose, there is no user configuration, and the behavior fires automatically on `npm install` via the preinstall lifecycle hook as well as on any `require()`/`import` of the package. The harvested material — temporary AWS IAM credentials, cloud instance identity, arbitrary environment variables (which routinely contain API keys, tokens, and database credentials in CI/build environments), and Kubernetes service-account tokens — grants immediate cross-service access to the installer's cloud and cluster resources.
## Source: ghsa-malware (07386b2d1e2efa71fd38c591953684c11302ad77f1c7943bd542b71fd83184e3)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @hrmony/benefit-essenszuschuss (version 3.99.0) contains malicious code that, upon import, harvests cloud and container secrets from the host environment. It retrieves AWS IAM role credentials via the Instance Metadata Service (IMDSv2), collects environment variables, and reads Kubernetes secrets from the filesystem. This sensitive data is then exfiltrated to a hardcoded attacker-controlled endpoint. The package mimics an internal HR utility and includes an unpinned dependency, facilitating a dependency confusion attack. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/account-management version 1.99.0 contains malicious code that executes upon import. It collects sensitive AWS instance metadata, environment variables, and Kubernetes secrets, then exfiltrates this data to an attacker-controlled server. This package is part of a dependency confusion or scope-squatting attack targeting an internal npm scope. Systems with this package installed should be considered fully compromised, and all secrets must be rotated immediately.
The npm package @hrmony/app-gateway-templates (version 0.0.51) contains malicious code that exfiltrates sensitive AWS instance metadata, IAM credentials, environment variables, and Kubernetes secrets to an attacker-controlled endpoint. The package is a typosquat of 'harmony' and also pulls in additional attacker-controlled dependencies. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @hrmony/interfaces (version 0.99.0) contains malicious code that executes upon import or require. It collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, and Kubernetes secrets, then exfiltrates this data to a hardcoded external server. This behavior is consistent with a dependency confusion attack. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @hrmony/benefit-internetzuschuss (version 1.99.0) contains malicious code that, upon import, sends AWS instance metadata, environment variables, Kubernetes secrets, and IAM credentials to a hardcoded external attacker-controlled server. This package masquerades as a German social-benefits helper but performs unauthorized credential harvesting. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/cdk-constructs contains malicious code that executes immediately upon import or require. It harvests AWS EC2 instance metadata, including IAM role credentials, environment variables, and Kubernetes secrets, then exfiltrates this sensitive information to a hardcoded external server. The package is a typosquatting attempt targeting developers seeking legitimate AWS CDK constructs under the @harmony scope. It also installs an additional attacker-controlled dependency. Systems with this package installed should be considered fully compromised, and all secrets must be rotated immediately.
The npm package @hrmony/benefit-mobilitaet version 1.99.0 contains malicious code that, upon loading, contacts the EC2 Instance Metadata Service to retrieve sensitive instance identity and IAM role credentials. It also enumerates environment variables and Kubernetes secrets, then exfiltrates all collected data to a hardcoded attacker-controlled endpoint. This behavior indicates a dependency-confusion attack pattern and results in full compromise of any system running this package.
The npm package @hrmony/organisationsverwaltung version 7.99.0 contains malicious code that executes immediately upon import or require. It exfiltrates AWS IAM credentials, environment variables, and Kubernetes secrets by sending them to a hardcoded external server. This package is a dependency-confusion attack targeting an internal namespace. Systems with this package installed should be considered fully compromised, and all secrets should be rotated from a clean environment.
The npm package @hrmony/benefit-sachbezug (version 1.99.0) contains malicious code that executes upon import or require. It collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, Kubernetes secrets, and user data, then sends this information to a hardcoded attacker-controlled endpoint. This behavior effectively compromises any system running the package, risking exposure of all stored secrets and keys.
The npm package @hrmony/benefitverwaltung version 1.99.0 contains malicious code that exfiltrates sensitive data from the host system. Upon import, it sends identifying information to a suspicious external domain and harvests AWS instance metadata, environment variables, and Kubernetes secrets. This activity compromises the security of any system running the package, potentially exposing all stored secrets and credentials.
The npm package @hrmony/pladddform-application version 2.99.0 contains malicious code that exfiltrates sensitive information from the host system. Upon loading, it executes routines that send installer-side secrets, AWS EC2 instance metadata including IAM role credentials, environment variables, and Kubernetes secrets to a hardcoded attacker-controlled endpoint. This package is likely a dependency confusion attack targeting internal package names. Any system with this package installed should be considered fully compromised.
The npm package '@hrmony/middlewares' is a malicious package designed to exfiltrate AWS instance metadata, IAM credentials, environment variables, and Kubernetes secrets to a hardcoded external server. It impersonates the legitimate '@harmony/middlewares' package by using a similar name. Installing or running this package compromises the host, potentially exposing all stored secrets and keys.
The npm package @hrmony/mailer-pladddform contains malicious code that executes immediately upon import. It harvests AWS IAM credentials, EC2 instance identity documents, Kubernetes ServiceAccount tokens, and other secrets from the host environment and exfiltrates them to a hardcoded attacker-controlled endpoint. The package does not provide any legitimate mailer functionality and appears to be a typosquatting or dependency confusion attack. Installation of this package compromises the host system, requiring immediate secret rotation and removal of the package.