The npm package @hrmony/gutscheinverwaltung version 1.99.0 contains malicious code that, upon loading, collects sensitive AWS EC2 instance metadata, environment variables, and Kubernetes secrets. This data is exfiltrated to a hardcoded external endpoint. The package has no legitimate functionality and appears to be a dependency-confusion attack targeting internal @hrmony scope packages. Systems with this package installed should be considered fully compromised.