Malicious code in @hrmony/component-library (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a93efe09ed89a9899669e54f614f80d91a80c59d77e0c2a2f673f92590488804) index.js (declared as the package main) runs top-level async code on require/import that performs three exfiltration actions against a hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/. First, it POSTs a fixed beacon identifying the package to /save_instance_info_from_pkge_hrmony_component-library. Second, it queries the AWS EC2 Instance Metadata Service at 169.254.169.254 using IMDSv2, enumerates IAM roles, and reads iam/security-credentials/{role} to collect temporary AWS access keys along with the identity document and user-data, then POSTs the collected object to the same host. Third, it iterates every entry of process.env and recursively reads all files under /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets) and POSTs them to the same host. The package ships no component-library code; the exfiltration payload is its only behavior. The scope name @hrmony (missing the 'a' from @harmony) and the abnormally high 28.99.0 version are consistent with typosquat and dependency-confusion targeting. ## Source: ghsa-malware (43173bc756c5c7bb307d748364b7436b5691bd972fa14c3ab6f51a4a510aeafd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should b
MAL-2026-17259
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17259
@hrmony/component-library
Source reference: /affected/0/package/name
- Affected versions
- 28.99.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/component-library",
"purl": "pkg:npm/%40hrmony/component-library",
"ecosystem": "npm"
},
"versions": [
"28.99.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/component-library/MAL-2026-17259.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "adb1968642fb0421159f75ab8bbba0079036d1473949addc3f9c63842f4e4edea61bcd",
"sha256": "22b64d0c2884f2cfffd5c09b925a0c5da24d737aec0380616adbd56cef6d19bc"
},
{
"path": "package.json",
"tlsh": "bee020148530947355d561d21c6d8457b7624f5b840c3c0873db141c835f9b314fd7a9",
"sha256": "6936d7183bdc358984c1d028fc5ac16a6acdd5927e1150d8afd1b134d2e69b42"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "146410c73ee614767481790760218feec8a8975d",
"sha512_sri": "sha512-o1Ft2wtiCwUZa/mLmTbTtLvThzlD+++Q1ny959O9px569kgxArMf6+5mQPwIpTzcRc8nDFCFSzvoMAEMOMjY1Q=="
},
"filename": "component-library-28.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29729 · Revision 1
- Added to Heist Feed
- Publisher date