Malicious code in @hrmony/api-gateway-service-config (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4) index.js runs a top-level `await fetch(...)` on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_api-gateway-service-config. The code obtains an IMDSv2 token from 169.254.169.254, reads iam/security-credentials/ to collect short-lived AWS STS access keys, pulls instance identity, user-data, and network info, enumerates all of process.env, and recursively reads /var/run/secrets/ to capture Kubernetes service-account tokens and mounted secrets, then POSTs the aggregated JSON to the attacker host. The package also declares a single dependency on an unpublished scoped name `@hrmony/kit-5` (^1.0.0), a shape consistent with a dependency-confusion campaign against an internal `@hrmony/*` namespace. Merely installing and importing this package causes theft of cloud IAM credentials and cluster secrets from the host. ## Source: ghsa-malware (bcb3c77966118157b47b9311802c57043e383c671ed75f178323b96ff0177895) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee t
MAL-2026-17250
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17250
@hrmony/api-gateway-service-config
Source reference: /affected/0/package/name
- Affected versions
- 0.99.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/api-gateway-service-config",
"purl": "pkg:npm/%40hrmony/api-gateway-service-config",
"ecosystem": "npm"
},
"versions": [
"0.99.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/api-gateway-service-config/MAL-2026-17250.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "55b1878542fb0411159f75ab8bbb61079035d1473948addc3f9c63842f4d4ede961bcd",
"sha256": "640ff72630377d58adc8afa4d10b56401288dd62f0675b2f10591df1919db7d0"
},
{
"path": "package.json",
"tlsh": "5be06810c520843305d921a28c5e8457b7624f57541c3c0c33eb200c824edb704fd76a",
"sha256": "c4ece1600c8ea2e172b04640fcba05c424ad0cf88cc916128c91bb0cc08bb2c0"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "3ce86d3f3f2b650fcdad06317e504b6c90ffae22",
"sha512_sri": "sha512-VgVD7lL3x8OgbfIhlRlOBdAeskCkZfyBomFBT5VMpqIe01KlKXtFSgm/A5WAAnoK7B386u4UwbAkB3dqOs6DZA=="
},
"filename": "api-gateway-service-config-0.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29727 · Revision 1
- Added to Heist Feed
- Publisher date