The npm package @hrmony/pladddform-application version 2.99.0 contains malicious code that exfiltrates sensitive information from the host system. Upon loading, it executes routines that send installer-side secrets, AWS EC2 instance metadata including IAM role credentials, environment variables, and Kubernetes secrets to a hardcoded attacker-controlled endpoint. This package is likely a dependency confusion attack targeting internal package names. Any system with this package installed should be considered fully compromised.
The npm package '@hrmony/middlewares' is a malicious package designed to exfiltrate AWS instance metadata, IAM credentials, environment variables, and Kubernetes secrets to a hardcoded external server. It impersonates the legitimate '@harmony/middlewares' package by using a similar name. Installing or running this package compromises the host, potentially exposing all stored secrets and keys.
The npm package @hrmony/mailer-pladddform contains malicious code that executes immediately upon import. It harvests AWS IAM credentials, EC2 instance identity documents, Kubernetes ServiceAccount tokens, and other secrets from the host environment and exfiltrates them to a hardcoded attacker-controlled endpoint. The package does not provide any legitimate mailer functionality and appears to be a typosquatting or dependency confusion attack. Installation of this package compromises the host system, requiring immediate secret rotation and removal of the package.
The npm package @hrmony/component-library (version 28.99.0) contains malicious code that exfiltrates sensitive data from infected systems. Upon import, it performs unauthorized data collection and sends it to a hardcoded attacker endpoint. This includes AWS EC2 metadata, IAM credentials, Kubernetes secrets, and environment variables. The package appears to be a typosquat of a legitimate package and does not provide any legitimate functionality. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/pladddform-codegen version 49.99.0 is a malicious typosquat that exfiltrates sensitive AWS and Kubernetes credentials and environment data to a hardcoded attacker-controlled endpoint. It performs multiple credential-harvesting actions including querying the AWS instance metadata service, enumerating environment variables, and reading Kubernetes secrets. The package is part of a dependency-confusion style campaign and should be considered fully compromising any system where it is installed.
The npm package @hrmony/pladddform-config contains malicious code that executes immediately upon import. It collects sensitive data including AWS EC2 instance metadata, IAM roles, environment variables, and Kubernetes secrets, then exfiltrates this information to a hardcoded external server. The package has no legitimate functionality and uses a deceptive naming scheme consistent with dependency confusion attacks. Any system with this package installed should be considered fully compromised.
The npm package '@hrmony/pladddform-cli' version 40.14.3 contains malicious code that exfiltrates sensitive cloud and Kubernetes credentials to an attacker-controlled endpoint. Upon import, it sends a beacon, retrieves AWS IAM role credentials and instance metadata, and collects Kubernetes secrets and environment variables, posting all data to a suspicious external domain. This enables immediate cloud account and cluster takeover. The package name is a typosquatting variant of a legitimate package, increasing the risk of accidental installation. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/pladddform-shared-infrastructure (version 40.14.3) contains malicious code that exfiltrates sensitive information from hosts importing it. Upon import, it executes routines that send harvested secrets, including AWS EC2 instance metadata, IAM credentials, Kubernetes secrets, and environment variables, to a hardcoded attacker-controlled endpoint. This package appears to be a dependency confusion lure with a typo in its name and additional dependencies under the same malicious scope. Any system running this package should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @hrmony/pladddform-partner-registry is a malicious typosquatting package that exfiltrates cloud and container secrets upon import. It harvests AWS EC2 metadata, IAM role credentials, environment variables, Kubernetes secrets, and other sensitive data, sending them to an attacker-controlled endpoint. The package provides no legitimate functionality and is part of a coordinated typosquatting and dependency confusion campaign. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/pladddform-testing contains malicious code that executes immediately upon import. It exfiltrates sensitive data from the host environment, including AWS EC2 instance metadata, IAM credentials, environment variables, and Kubernetes secrets. The stolen data is sent to a hardcoded attacker-controlled endpoint. The package has no legitimate functionality and appears to be a typosquatting or dependency confusion attack targeting similarly named internal packages. Any system with this package installed should be considered fully compromised.
The npm package @hrmony/api-gateway-service-config (version 0.99.0) contains malicious code that, upon import, steals cloud IAM credentials and Kubernetes secrets from the host. It fetches AWS IMDSv2 tokens, instance metadata, environment variables, and secrets, then exfiltrates this data to a hardcoded attacker endpoint. The package also depends on an unpublished scoped package, indicating a dependency confusion attack. Installing or running this package compromises the host, requiring immediate secret rotation and package removal.
The npm package @hrmony/valuenet version 1.99.0 contains malicious code that executes upon import or require. It collects sensitive AWS instance metadata, environment variables, and Kubernetes secrets, then exfiltrates this data to a hardcoded attacker-controlled endpoint. This behavior indicates a dependency confusion attack targeting internal @hrmony scoped packages. Systems with this package installed should be considered fully compromised.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb)
On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-infrastructure (host encodes the package name in the path). An aws_get() routine calls the AWS Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates instance/identity metadata, iterates iam/security-credentials/<role> to retrieve short-lived IAM role credentials, and ships the result to the same attacker host. A local_get() routine serializes the entire process.env and recursively reads /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets), then POSTs the combined blob to the same endpoint. The package also declares a runtime dependency on @hrmony/kit-5 under the same scope, pulling additional code controlled by the same actor into any installer's environment. The package name and scope resemble a legitimate internal-sounding infrastructure package (typosquat/dependency-confusion shape targeting an internal '@harmony/platform-infrastructure'-style name).
## Source: ghsa-malware (fedcb513cf9f7b4f7d6598b35e8076c44199eadc1f143d5f46787b7635e0c30b)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @hrmony/belegerfassung-pladddform (version 1.99.0) contains malicious code that executes immediately upon import. It sends a beacon to a hardcoded attacker-controlled endpoint, then collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, and Kubernetes secrets, exfiltrating all this data to the same endpoint. The package uses a typosquatting name resembling a legitimate package and includes a transitive dependency from the same attacker-controlled scope, increasing the attack surface. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/devtool-configuration version 1.99.0 contains malicious code that exfiltrates sensitive AWS EC2 instance metadata, IAM credentials, Kubernetes secrets, and environment variables to an attacker-controlled server immediately upon module import. This results in a full compromise of any system running this package.
The npm package @hrmony/lohndateien version 3.99.0 contains malicious code that executes upon module load. It sends a beacon to a remote attacker-controlled server, collects AWS EC2 instance metadata including IAM role credentials, environment variables, and Kubernetes secrets, and exfiltrates this sensitive information. Installing or running this package on an EC2 host or Kubernetes workload results in full compromise of AWS credentials and secrets.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9)
@hrmony/pladddform-frontend@48.99.0 ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-frontend and then invokes two harvesters. aws_get() queries the AWS EC2 Instance Metadata Service at 169.254.169.254 using IMDSv2 (PUT /latest/api/token) and sweeps /latest/meta-data/iam/security-credentials/ to collect instance identity, IAM role names, and temporary IAM security credentials. local_get() enumerates every entry of process.env and recursively reads /var/run/secrets/, capturing Kubernetes-mounted service-account tokens and secret files. Both payloads are POSTed to the same hardcoded hrnmn.dd.h4x.tv endpoint. The package has an empty description, no functional code beyond the stealer, an intentionally misspelled scope and name mimicking an internal 'harmony/platform-frontend', and declares a dependency on the similarly look-alike '@hrmony/kit-5', consistent with a dependency-confusion typosquat targeting an internal package name.
## Source: ghsa-malware (37ed7f1bf9d1ce61730644e3ac7eaf7f1525da3d26b9f9ba1f171d2ff2b72ae6)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605)
On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 (IMDSv2), retrieves the instance identity document, network interface information, and IAM security-credentials for every attached role (including temporary access key IDs, secret access keys, and session tokens), then POSTs the aggregated data to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-core. In the same import-time code path, it enumerates every entry in process.env and recursively reads all files under /var/run/secrets/ (Kubernetes service account tokens and mounted secrets) and POSTs those to the same host. The package exposes no functional API; its only behavior on require/import is credential and secret harvesting. package.json also declares a runtime dependency on the sibling scoped package @hrmony/kit-5 at ^1.0.0, which is fetched from the same author scope during install. The scoped name @hrmony/pladddform-core resembles a legitimate 'platform-core' package name, and the exfil host uses an attacker-controlled domain (h4x.tv) with a self-descriptive path.
## Source: ghsa-malware (547a909639f309cae645a90e1026d88e24c83cf90074a334e0dfb30a2b77f440)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @hrmony/gutscheinverwaltung version 1.99.0 contains malicious code that, upon loading, collects sensitive AWS EC2 instance metadata, environment variables, and Kubernetes secrets. This data is exfiltrated to a hardcoded external endpoint. The package has no legitimate functionality and appears to be a dependency-confusion attack targeting internal @hrmony scope packages. Systems with this package installed should be considered fully compromised.
The npm package dotenv-preflight@1.0.0 is a malicious package that masquerades as a dotenv-related utility but contains heavily obfuscated JavaScript code. This obfuscation is unusual for such tooling and is indicative of concealed malicious behavior, likely credential theft or data exfiltration. The package name is similar to legitimate dotenv packages, increasing the risk of accidental installation. The malicious code executes upon requiring the package, potentially compromising any project that includes it.