The npm package @hrmony/benefit-mobilitaet version 1.99.0 contains malicious code that, upon loading, contacts the EC2 Instance Metadata Service to retrieve sensitive instance identity and IAM role credentials. It also enumerates environment variables and Kubernetes secrets, then exfiltrates all collected data to a hardcoded attacker-controlled endpoint. This behavior indicates a dependency-confusion attack pattern and results in full compromise of any system running this package.