The npm package @hrmony/app-gateway-templates (version 0.0.51) contains malicious code that exfiltrates sensitive AWS instance metadata, IAM credentials, environment variables, and Kubernetes secrets to an attacker-controlled endpoint. The package is a typosquat of 'harmony' and also pulls in additional attacker-controlled dependencies. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.