The npm package @hrmony/api-gateway-service-config (version 0.99.0) contains malicious code that, upon import, steals cloud IAM credentials and Kubernetes secrets from the host. It fetches AWS IMDSv2 tokens, instance metadata, environment variables, and secrets, then exfiltrates this data to a hardcoded attacker endpoint. The package also depends on an unpublished scoped package, indicating a dependency confusion attack. Installing or running this package compromises the host, requiring immediate secret rotation and package removal.