The npm package @hrmony/benefit-sachbezug (version 1.99.0) contains malicious code that executes upon import or require. It collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, Kubernetes secrets, and user data, then sends this information to a hardcoded attacker-controlled endpoint. This behavior effectively compromises any system running the package, risking exposure of all stored secrets and keys.