The npm package @hrmony/benefitverwaltung version 1.99.0 contains malicious code that exfiltrates sensitive data from the host system. Upon import, it sends identifying information to a suspicious external domain and harvests AWS instance metadata, environment variables, and Kubernetes secrets. This activity compromises the security of any system running the package, potentially exposing all stored secrets and credentials.