The npm package @hrmony/valuenet version 1.99.0 contains malicious code that executes upon import or require. It collects sensitive AWS instance metadata, environment variables, and Kubernetes secrets, then exfiltrates this data to a hardcoded attacker-controlled endpoint. This behavior indicates a dependency confusion attack targeting internal @hrmony scoped packages. Systems with this package installed should be considered fully compromised.