The npm package @hrmony/benefit-internetzuschuss (version 1.99.0) contains malicious code that, upon import, sends AWS instance metadata, environment variables, Kubernetes secrets, and IAM credentials to a hardcoded external attacker-controlled server. This package masquerades as a German social-benefits helper but performs unauthorized credential harvesting. Systems with this package installed should be considered fully compromised.