The npm package '@hrmony/pladddform-cli' version 40.14.3 contains malicious code that exfiltrates sensitive cloud and Kubernetes credentials to an attacker-controlled endpoint. Upon import, it sends a beacon, retrieves AWS IAM role credentials and instance metadata, and collects Kubernetes secrets and environment variables, posting all data to a suspicious external domain. This enables immediate cloud account and cluster takeover. The package name is a typosquatting variant of a legitimate package, increasing the risk of accidental installation. Systems with this package installed should be considered fully compromised.