The npm package @hrmony/component-library (version 28.99.0) contains malicious code that exfiltrates sensitive data from infected systems. Upon import, it performs unauthorized data collection and sends it to a hardcoded attacker endpoint. This includes AWS EC2 metadata, IAM credentials, Kubernetes secrets, and environment variables. The package appears to be a typosquat of a legitimate package and does not provide any legitimate functionality. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/pladddform-codegen version 49.99.0 is a malicious typosquat that exfiltrates sensitive AWS and Kubernetes credentials and environment data to a hardcoded attacker-controlled endpoint. It performs multiple credential-harvesting actions including querying the AWS instance metadata service, enumerating environment variables, and reading Kubernetes secrets. The package is part of a dependency-confusion style campaign and should be considered fully compromising any system where it is installed.
The npm package @hrmony/pladddform-config contains malicious code that executes immediately upon import. It collects sensitive data including AWS EC2 instance metadata, IAM roles, environment variables, and Kubernetes secrets, then exfiltrates this information to a hardcoded external server. The package has no legitimate functionality and uses a deceptive naming scheme consistent with dependency confusion attacks. Any system with this package installed should be considered fully compromised.
The npm package '@hrmony/pladddform-cli' version 40.14.3 contains malicious code that exfiltrates sensitive cloud and Kubernetes credentials to an attacker-controlled endpoint. Upon import, it sends a beacon, retrieves AWS IAM role credentials and instance metadata, and collects Kubernetes secrets and environment variables, posting all data to a suspicious external domain. This enables immediate cloud account and cluster takeover. The package name is a typosquatting variant of a legitimate package, increasing the risk of accidental installation. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/pladddform-shared-infrastructure (version 40.14.3) contains malicious code that exfiltrates sensitive information from hosts importing it. Upon import, it executes routines that send harvested secrets, including AWS EC2 instance metadata, IAM credentials, Kubernetes secrets, and environment variables, to a hardcoded attacker-controlled endpoint. This package appears to be a dependency confusion lure with a typo in its name and additional dependencies under the same malicious scope. Any system running this package should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @hrmony/pladddform-partner-registry is a malicious typosquatting package that exfiltrates cloud and container secrets upon import. It harvests AWS EC2 metadata, IAM role credentials, environment variables, Kubernetes secrets, and other sensitive data, sending them to an attacker-controlled endpoint. The package provides no legitimate functionality and is part of a coordinated typosquatting and dependency confusion campaign. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/pladddform-testing contains malicious code that executes immediately upon import. It exfiltrates sensitive data from the host environment, including AWS EC2 instance metadata, IAM credentials, environment variables, and Kubernetes secrets. The stolen data is sent to a hardcoded attacker-controlled endpoint. The package has no legitimate functionality and appears to be a typosquatting or dependency confusion attack targeting similarly named internal packages. Any system with this package installed should be considered fully compromised.
The npm package @hrmony/api-gateway-service-config (version 0.99.0) contains malicious code that, upon import, steals cloud IAM credentials and Kubernetes secrets from the host. It fetches AWS IMDSv2 tokens, instance metadata, environment variables, and secrets, then exfiltrates this data to a hardcoded attacker endpoint. The package also depends on an unpublished scoped package, indicating a dependency confusion attack. Installing or running this package compromises the host, requiring immediate secret rotation and package removal.
The npm package @hrmony/valuenet version 1.99.0 contains malicious code that executes upon import or require. It collects sensitive AWS instance metadata, environment variables, and Kubernetes secrets, then exfiltrates this data to a hardcoded attacker-controlled endpoint. This behavior indicates a dependency confusion attack targeting internal @hrmony scoped packages. Systems with this package installed should be considered fully compromised.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb)
On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-infrastructure (host encodes the package name in the path). An aws_get() routine calls the AWS Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates instance/identity metadata, iterates iam/security-credentials/<role> to retrieve short-lived IAM role credentials, and ships the result to the same attacker host. A local_get() routine serializes the entire process.env and recursively reads /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets), then POSTs the combined blob to the same endpoint. The package also declares a runtime dependency on @hrmony/kit-5 under the same scope, pulling additional code controlled by the same actor into any installer's environment. The package name and scope resemble a legitimate internal-sounding infrastructure package (typosquat/dependency-confusion shape targeting an internal '@harmony/platform-infrastructure'-style name).
## Source: ghsa-malware (fedcb513cf9f7b4f7d6598b35e8076c44199eadc1f143d5f46787b7635e0c30b)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @hrmony/belegerfassung-pladddform (version 1.99.0) contains malicious code that executes immediately upon import. It sends a beacon to a hardcoded attacker-controlled endpoint, then collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, and Kubernetes secrets, exfiltrating all this data to the same endpoint. The package uses a typosquatting name resembling a legitimate package and includes a transitive dependency from the same attacker-controlled scope, increasing the attack surface. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/devtool-configuration version 1.99.0 contains malicious code that exfiltrates sensitive AWS EC2 instance metadata, IAM credentials, Kubernetes secrets, and environment variables to an attacker-controlled server immediately upon module import. This results in a full compromise of any system running this package.
The npm package @hrmony/lohndateien version 3.99.0 contains malicious code that executes upon module load. It sends a beacon to a remote attacker-controlled server, collects AWS EC2 instance metadata including IAM role credentials, environment variables, and Kubernetes secrets, and exfiltrates this sensitive information. Installing or running this package on an EC2 host or Kubernetes workload results in full compromise of AWS credentials and secrets.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9)
@hrmony/pladddform-frontend@48.99.0 ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-frontend and then invokes two harvesters. aws_get() queries the AWS EC2 Instance Metadata Service at 169.254.169.254 using IMDSv2 (PUT /latest/api/token) and sweeps /latest/meta-data/iam/security-credentials/ to collect instance identity, IAM role names, and temporary IAM security credentials. local_get() enumerates every entry of process.env and recursively reads /var/run/secrets/, capturing Kubernetes-mounted service-account tokens and secret files. Both payloads are POSTed to the same hardcoded hrnmn.dd.h4x.tv endpoint. The package has an empty description, no functional code beyond the stealer, an intentionally misspelled scope and name mimicking an internal 'harmony/platform-frontend', and declares a dependency on the similarly look-alike '@hrmony/kit-5', consistent with a dependency-confusion typosquat targeting an internal package name.
## Source: ghsa-malware (37ed7f1bf9d1ce61730644e3ac7eaf7f1525da3d26b9f9ba1f171d2ff2b72ae6)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605)
On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 (IMDSv2), retrieves the instance identity document, network interface information, and IAM security-credentials for every attached role (including temporary access key IDs, secret access keys, and session tokens), then POSTs the aggregated data to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-core. In the same import-time code path, it enumerates every entry in process.env and recursively reads all files under /var/run/secrets/ (Kubernetes service account tokens and mounted secrets) and POSTs those to the same host. The package exposes no functional API; its only behavior on require/import is credential and secret harvesting. package.json also declares a runtime dependency on the sibling scoped package @hrmony/kit-5 at ^1.0.0, which is fetched from the same author scope during install. The scoped name @hrmony/pladddform-core resembles a legitimate 'platform-core' package name, and the exfil host uses an attacker-controlled domain (h4x.tv) with a self-descriptive path.
## Source: ghsa-malware (547a909639f309cae645a90e1026d88e24c83cf90074a334e0dfb30a2b77f440)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @hrmony/gutscheinverwaltung version 1.99.0 contains malicious code that, upon loading, collects sensitive AWS EC2 instance metadata, environment variables, and Kubernetes secrets. This data is exfiltrated to a hardcoded external endpoint. The package has no legitimate functionality and appears to be a dependency-confusion attack targeting internal @hrmony scope packages. Systems with this package installed should be considered fully compromised.
The npm package dotenv-preflight@1.0.0 is a malicious package that masquerades as a dotenv-related utility but contains heavily obfuscated JavaScript code. This obfuscation is unusual for such tooling and is indicative of concealed malicious behavior, likely credential theft or data exfiltration. The package name is similar to legitimate dotenv packages, increasing the risk of accidental installation. The malicious code executes upon requiring the package, potentially compromising any project that includes it.
The npm package 'rai6jaisahthaghee5ou-loader-package' version 1.0.0 contains malicious code that injects a script element pointing to an attacker-controlled URL. This causes arbitrary JavaScript from the external host to execute within the context of any application bundling this package, enabling full code execution, credential or session theft, and further malicious actions.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc)
hardhat-zet@2.0.1 is published under a name that impersonates the Hardhat Ethereum tooling ecosystem, but its README, type definitions and docs/ tree are copied verbatim from the unrelated `pino` logger project (badges and links point at npmjs.com/package/pino and github.com/pinojs/pino). The exported `middleware` in index.js is a no-op Express middleware and matches neither the `hardhat-zet` name nor the pino README. The package's declared main (index.js) top-level-requires./lib/config, which is not a configuration file but a 4,498,609-byte obfuscator.io-style bundle: a 26,113-entry rotated string array behind two runtime decoders (functions v and F), hex-encoded identifiers, and control-flow flattening. All strings and destination URLs are hidden behind the decoders, so this code runs automatically on any `require('hardhat-zet')` and its behavior is not observable without deobfuscation. Publisher metadata (author 'Robert King <hello@jsonspack.com>', bugs URL https://jsonspack.com/issues) ties to neither the Hardhat nor the pino identity. The combination — ecosystem-typosquat name targeting crypto/Hardhat developers, cover-story README lifted from an unrelated popular package, no-op public API, and a multi-megabyte obfuscated payload auto-executed on import — is the shape of a supply-chain stealer aimed at Ethereum developers.
## Source: ghsa-malware (781273d2c802d3781fecccd4434ba418c93ce88edf920b2a1163dbacf7576254)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package hardhat-lock@2.21.0 is a malicious package that impersonates a legitimate logging/middleware library but contains a large, heavily obfuscated payload that executes immediately upon import. This payload grants attacker-controlled code unrestricted access to environment variables, filesystem, and network within the Node.js process. The package misuses the Ethereum tooling keyword 'hardhat' and copies unrelated project documentation to disguise its true nature.