The npm package @hrmony/component-library (version 28.99.0) contains malicious code that exfiltrates sensitive data from infected systems. Upon import, it performs unauthorized data collection and sends it to a hardcoded attacker endpoint. This includes AWS EC2 metadata, IAM credentials, Kubernetes secrets, and environment variables. The package appears to be a typosquat of a legitimate package and does not provide any legitimate functionality. Systems with this package installed should be considered fully compromised.