The npm package @hrmony/pladddform-shared-infrastructure (version 40.14.3) contains malicious code that exfiltrates sensitive information from hosts importing it. Upon import, it executes routines that send harvested secrets, including AWS EC2 instance metadata, IAM credentials, Kubernetes secrets, and environment variables, to a hardcoded attacker-controlled endpoint. This package appears to be a dependency confusion lure with a typo in its name and additional dependencies under the same malicious scope. Any system running this package should be considered fully compromised, and all secrets should be rotated immediately.