The npm package @hrmony/belegerfassung-pladddform (version 1.99.0) contains malicious code that executes immediately upon import. It sends a beacon to a hardcoded attacker-controlled endpoint, then collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, and Kubernetes secrets, exfiltrating all this data to the same endpoint. The package uses a typosquatting name resembling a legitimate package and includes a transitive dependency from the same attacker-controlled scope, increasing the attack surface. Systems with this package installed should be considered fully compromised.