The npm package @hrmony/pladddform-application version 2.99.0 contains malicious code that exfiltrates sensitive information from the host system. Upon loading, it executes routines that send installer-side secrets, AWS EC2 instance metadata including IAM role credentials, environment variables, and Kubernetes secrets to a hardcoded attacker-controlled endpoint. This package is likely a dependency confusion attack targeting internal package names. Any system with this package installed should be considered fully compromised.