Malicious code in @hrmony/benefit-sachbezug (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a) The package's main entry (index.js) executes at require/import time and POSTs harvested data to the hardcoded endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_benefit-sachbezug. One path queries the AWS EC2 Instance Metadata Service (IMDSv2), obtains a token via PUT to /latest/api/token, and retrieves the instance identity document, IAM role temporary credentials via iam/security-credentials/, network and security-group metadata, and user-data. A second path enumerates all process.env entries and recursively reads /var/run/secrets/, the standard mount path for Kubernetes service-account tokens and mounted secrets, and sends both to the same author-controlled host. The package name (@hrmony/benefit-sachbezug), empty description, ISC license, and beacon body {"c53":"hello"} with the endpoint path keyed to the scope name match the dependency-confusion beacon pattern targeting an internal @hrmony scope. ## Source: ghsa-malware (9cae12d795a901843e179a21778555597220721130f13c98674c03c9adecf984) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no gu
MAL-2026-17256
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17256
@hrmony/benefit-sachbezug
Source reference: /affected/0/package/name
- Affected versions
- 1.99.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/benefit-sachbezug",
"purl": "pkg:npm/%40hrmony/benefit-sachbezug",
"ecosystem": "npm"
},
"versions": [
"1.99.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/benefit-sachbezug/MAL-2026-17256.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "f2b1868542fb0411159f79ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "6df3ac8be53fbfd6761dcd9ae9af55c6b56735814e4a66c8ab45d89f0c5029ac"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "447823f079b3fb5b519c039f9203df480a994062",
"sha512_sri": "sha512-I2MpL8fNYzU8GYRMg+yRUPgKONixRp6Ifi78dZknGVJcE6VkSOuwdyYuY8fORDF2oqCLde6459WyFb1YeYaS2Q=="
},
"filename": "benefit-sachbezug-1.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29717 · Revision 1
- Added to Heist Feed
- Publisher date