Malicious code in @hrmony/mailer-pladddform (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cc17a6ae94f3beee4d60886e3233b210660bcd01f6c5f6d2fff840e6d385973b) index.js executes at top-level import and performs three credential-harvesting flows directed at https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_mailer-pladddform. First, aws_get() requests an IMDSv2 token from 169.254.169.254, then walks /latest/meta-data/iam/security-credentials/ to extract IAM role credentials and the EC2 instance identity document. Second, local_get() enumerates all process.env entries and recursively reads /var/run/secrets/ via fs.readdirSync/readFileSync to collect Kubernetes ServiceAccount tokens and other mounted secrets. The collected data is POSTed as JSON to the hardcoded attacker endpoint. The package ships no mailer functionality — index.js contains only the exfiltration logic — and the name uses misspellings ('hrmony', 'pladddform') consistent with a typosquat/dependency-confusion lure. package.json also declares a same-scope dependency @hrmony/kit-5 ^1.0.0, pulling additional attacker-controlled code into the install. ## Source: ghsa-malware (e55c74a1670a195985ea14410e06687c5d4bdb42525e95edbc76fdb94c69e094) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been
MAL-2026-17268
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17268
@hrmony/mailer-pladddform
Source reference: /affected/0/package/name
- Affected versions
- 1.99.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/mailer-pladddform",
"purl": "pkg:npm/%40hrmony/mailer-pladddform",
"ecosystem": "npm"
},
"versions": [
"1.99.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/mailer-pladddform/MAL-2026-17268.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "95b1768542fb0421159f75ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "57868fc815d2bfedf2520490d8bf5acf05a25b27bbeba88ef71d94287991f7af"
},
{
"path": "package.json",
"tlsh": "b2e020108531557346c561e21c5ec457b7624f5b540c3d1c33db101cc25eeb354fd76a",
"sha256": "b8ad865395cd2a34478be9ca24b8a164a0705bdfc26e803f1e14e3f0225286fe"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "b96514ed6182f3f12c5f2ad3f5375c3b12cc6374",
"sha512_sri": "sha512-uxZucKFW+0ij5nR8qUWtNyUDVQUTgxTD1bwUiI3BcVKNR0cUA/6zzuI6/hHdxRztHs12fNUYZdYwFHxyV5sWLg=="
},
"filename": "mailer-pladddform-1.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29726 · Revision 1
- Added to Heist Feed
- Publisher date