The npm package @hrmony/devtool-configuration version 1.99.0 contains malicious code that exfiltrates sensitive AWS EC2 instance metadata, IAM credentials, Kubernetes secrets, and environment variables to an attacker-controlled server immediately upon module import. This results in a full compromise of any system running this package.