The npm package @hrmony/pladddform-config contains malicious code that executes immediately upon import. It collects sensitive data including AWS EC2 instance metadata, IAM roles, environment variables, and Kubernetes secrets, then exfiltrates this information to a hardcoded external server. The package has no legitimate functionality and uses a deceptive naming scheme consistent with dependency confusion attacks. Any system with this package installed should be considered fully compromised.