MAL-2026-17268

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cc17a6ae94f3beee4d60886e3233b210660bcd01f6c5f6d2fff840e6d385973b)

index.js executes at top-level import and performs three credential-harvesting flows directed at https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_mailer-pladddform. First, aws_get() requests an IMDSv2 token from 169.254.169.254, then walks /latest/meta-data/iam/security-credentials/ to extract IAM role credentials and the EC2 instance identity document. Second, local_get() enumerates all process.env entries and recursively reads /var/run/secrets/ via fs.readdirSync/readFileSync to collect Kubernetes ServiceAccount tokens and other mounted secrets. The collected data is POSTed as JSON to the hardcoded attacker endpoint. The package ships no mailer functionality — index.js contains only the exfiltration logic — and the name uses misspellings ('hrmony', 'pladddform') consistent with a typosquat/dependency-confusion lure. package.json also declares a same-scope dependency @hrmony/kit-5 ^1.0.0, pulling additional attacker-controlled code into the install.

Source: ghsa-malware (e55c74a1670a195985ea14410e06687c5d4bdb42525e95edbc76fdb94c69e094)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.