The npm package @hrmony/interfaces (version 0.99.0) contains malicious code that executes upon import or require. It collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, and Kubernetes secrets, then exfiltrates this data to a hardcoded external server. This behavior is consistent with a dependency confusion attack. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.