Malicious code in @hrmony/organisationsverwaltung (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (78807365ee9728923ec2d5d103ce7f4562b21e2fc8185483b482bb5d2f79748d) @hrmony/organisationsverwaltung 7.99.0 executes credential-theft code at the top level of index.js, so simply requiring or importing the package triggers exfiltration. On load it sends a hello beacon via POST to https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_organisationsverwaltung, then queries the AWS EC2 Instance Metadata Service at 169.254.169.254 (IMDSv2) to retrieve IAM role security-credentials and identity documents, enumerates all entries of process.env, and recursively reads every file under /var/run/secrets/ (the mount path for Kubernetes service-account tokens and mounted secrets). The collected AWS credentials, environment variables, and Kubernetes secrets are POSTed as a JSON payload to the same hardcoded endpoint at hrnmn.dd.h4x.tv. Package metadata (empty description, no repository, version 7.99.0 published under the @hrmony scope with a self-declared @hrmony/kit-5 dependency) is consistent with a dependency-confusion package targeting an internal @hrmony/* namespace. ## Source: ghsa-malware (078cf96d70a32e670e25a0be40b81d1d8e95bbffc9ccb5129a174c61e21b8fcd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full c
MAL-2026-17270
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17270
@hrmony/organisationsverwaltung
Source reference: /affected/0/package/name
- Affected versions
- 7.99.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/organisationsverwaltung",
"purl": "pkg:npm/%40hrmony/organisationsverwaltung",
"ecosystem": "npm"
},
"versions": [
"7.99.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/organisationsverwaltung/MAL-2026-17270.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "80b1868642fb0421159f75ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "533d2bdd29eb2278bc9716ab81fd07195593a576279cd27ac077e600b0ff64b6"
},
{
"path": "package.json",
"tlsh": "9ae0df108530953345c561a20c9e8867ab72cf6b840c3c0837eb701cc26eeb714febae",
"sha256": "2ac7d970f949c0297767b2d5eb37f726771b28e6869b89d4564040e45240fe66"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "f7bbbb3067786124542fce14892b4856153aa586",
"sha512_sri": "sha512-Lo+BnbBE27Z8sQbOejYGXHDu5lgkLsJgxhCe3i9Qpl0wN7fM87LvB3XIQDFC+oDBjijzCfrWNVrhI4iE99l6OQ=="
},
"filename": "organisationsverwaltung-7.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29739 · Revision 1
- Added to Heist Feed
- Publisher date