The npm package @hrmony/account-management version 1.99.0 contains malicious code that executes upon import. It collects sensitive AWS instance metadata, environment variables, and Kubernetes secrets, then exfiltrates this data to an attacker-controlled server. This package is part of a dependency confusion or scope-squatting attack targeting an internal npm scope. Systems with this package installed should be considered fully compromised, and all secrets must be rotated immediately.