Malicious code in @hrmony/pladddform-core (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605) On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 (IMDSv2), retrieves the instance identity document, network interface information, and IAM security-credentials for every attached role (including temporary access key IDs, secret access keys, and session tokens), then POSTs the aggregated data to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-core. In the same import-time code path, it enumerates every entry in process.env and recursively reads all files under /var/run/secrets/ (Kubernetes service account tokens and mounted secrets) and POSTs those to the same host. The package exposes no functional API; its only behavior on require/import is credential and secret harvesting. package.json also declares a runtime dependency on the sibling scoped package @hrmony/kit-5 at ^1.0.0, which is fetched from the same author scope during install. The scoped name @hrmony/pladddform-core resembles a legitimate 'platform-core' package name, and the exfil host uses an attacker-controlled domain (h4x.tv) with a self-descriptive path. ## Source: ghsa-malware (547a909639f309cae645a90e1026d88e24c83cf90074a334e0dfb30a2b77f440) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys s
MAL-2026-17275
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17275
@hrmony/pladddform-core
Source reference: /affected/0/package/name
- Affected versions
- 2.99.0
Source reference:
/affected/0/versions49.3.0Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/pladddform-core",
"purl": "pkg:npm/%40hrmony/pladddform-core",
"ecosystem": "npm"
},
"versions": [
"2.99.0",
"49.3.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/pladddform-core/MAL-2026-17275.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "5ab1878542fb0421159f75ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "8b15ae118fa056c12af2e5867c6104dbc82e2cf3d7b7c865badcbfc557bb9f6d"
},
{
"path": "package.json",
"tlsh": "19e026208530953345c661a30c9ec867b7728f5b940c3c0c33eb601c825eeb354fe7aa",
"sha256": "ad048f15c580a435ee251d8ff684441516d8ac65073f21f1cdf54f3ae4e84928"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "4b548293f541abbae60b7a93b11e4e1daf63cc79",
"sha512_sri": "sha512-wRzjDaugBeR5R/08lEAtFmVE0095dMOTCjeYiSG1THNzohonWwl1GNfNkMfh309cO5n8azIPEAi4mO3OGRuyXg=="
},
"filename": "pladddform-core-2.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29720 · Revision 1
- Added to Heist Feed
- Publisher date