Malicious code in @hrmony/pladddform-codegen (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (58f0706d7223f8a1ff87ac80c6e1e42af148214545e55acc865cce12fee7eec4) On module load, index.js unconditionally beacons to the hardcoded non-first-party endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-codegen and then performs three credential-harvest flows against the installer: (1) queries the AWS instance metadata service at 169.254.169.254 (IMDSv2), enumerates IAM role names, retrieves each role's security credentials, and collects the EC2 identity document, user-data, and network-interface metadata; (2) enumerates all process.env entries; (3) recursively reads /var/run/secrets/ (Kubernetes projected service-account tokens and mounted secrets). The collected data is POSTed to the same hardcoded attacker host. The package name is a typosquat of an @hrmony scoped package with an inflated version (49.99.0) consistent with a dependency-confusion attempt, and it declares an internal-looking sibling dependency @hrmony/kit-5. The exfiltration URL path embeds the package name, indicating a campaign-style beacon per lure. ## Source: ghsa-malware (7506445769ecafceaa9997f0a2e50c59f9573d93d70ac74c88e105477033f05a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the comp
MAL-2026-17273
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17273
@hrmony/pladddform-codegen
Source reference: /affected/0/package/name
- Affected versions
- 49.99.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/pladddform-codegen",
"purl": "pkg:npm/%40hrmony/pladddform-codegen",
"ecosystem": "npm"
},
"versions": [
"49.99.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/pladddform-codegen/MAL-2026-17273.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "f1b1768542fb0421159f75ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "7c9dea2746e94da25fc2d9ef6b60b6aec3c637e441ede38874ffe630f14d90e6"
},
{
"path": "package.json",
"tlsh": "e7e0d8108530953349c561a20c5d8457a7624f5b944c3c0833db501c865e9b354fd7aa",
"sha256": "2b5560af82c16c95e068de362cb0a10f46cfab1fd060f57291cb98c3a81d778d"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "f7ec1111833db10f401a12b5a61ce02b09f7d7d0",
"sha512_sri": "sha512-IeAfcJ32o6Aezau64P7jT3FK6u44X19ZQzBHfUuMP64R3HOCG72dYPHT3vTZbPuyZPJgF3WSpbqAi21ipvTupQ=="
},
"filename": "pladddform-codegen-49.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29730 · Revision 1
- Added to Heist Feed
- Publisher date