Malicious code in @hrmony/pladddform-partner-registry (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e09dd7e6a7777c82ec319c374c862db40d6bf7210991dac9a7a250fda4a259e7) On import, index.js executes a top-level fetch that harvests cloud and container secrets from the installer host and POSTs them to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-partner-registry. The collection code queries the AWS EC2 Instance Metadata Service at 169.254.169.254 using IMDSv2, enumerates IAM role names under /iam/security-credentials/, fetches the temporary IAM security credentials, the instance identity document, and EC2 user-data, enumerates every entry of process.env, and recursively reads all files under /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets). The collected payload is serialized as JSON and sent to the attacker-controlled host. The package name uses a typo-shape ('pladddform') under the @hrmony scope and declares a dependency on a sibling '@hrmony/kit-5', consistent with a coordinated typosquat/dependency-confusion campaign. The package provides no legitimate functionality; its sole on-import effect is credential and secret exfiltration. ## Source: ghsa-malware (f8d38fe19118aa47b618021ff16cbe489dd597f9a0b7f3ad8a1024676ab505b6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different co
MAL-2026-17278
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17278
@hrmony/pladddform-partner-registry
Source reference: /affected/0/package/name
- Affected versions
- 40.14.3
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/pladddform-partner-registry",
"purl": "pkg:npm/%40hrmony/pladddform-partner-registry",
"ecosystem": "npm"
},
"versions": [
"40.14.3"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/pladddform-partner-registry/MAL-2026-17278.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "89b1878542fb0421159f79ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "46937fdf93f1e6a11f2b4d06b19802ea1b3ec6cb70714e05e432db6c13b74816"
},
{
"path": "package.json",
"tlsh": "e7e068208430853309c561a30c6d8457a7628f17900c3c0c33db501c824dab354fd36a",
"sha256": "50e1beb50aa673f2482258a6856acb35a49ac326e1a211ecf4b50cea2098f849"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "23dada9b26ffcf0e89a005fda4109fcb998c2658",
"sha512_sri": "sha512-XlkO2oNsz3cff7AhDTzOz0/c41sGIDTiHs9Sun422+XaLtolKWl0K4bRRUcac1c/NzIBo9FU1db3EgIlgWsuXw=="
},
"filename": "pladddform-partner-registry-40.14.3.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29745 · Revision 1
- Added to Heist Feed
- Publisher date