Malicious code in @hrmony/pladddform-testing (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096) On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadata Service at http://169.254.169.254 using IMDSv2 to enumerate the instance identity document, user-data, IAM role names, and the per-role temporary security credentials. It also enumerates every entry of process.env and recursively reads all files under /var/run/secrets/ (the standard Kubernetes service-account and secret mount). The combined data is POSTed to the hardcoded attacker endpoint https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-testing, and a separate top-level fetch to the same host beacons successful execution. The package ships no legitimate functionality: its only substantive file is the exfil script, the description is empty, and the name (@hrmony/pladddform-testing) plus the exfil URL path segment (pkge_hrmony_pladddform-testing) match a typosquat/dependency-confusion shape targeting an internal or similarly named scope. ## Source: ghsa-malware (c92cc1e06fa8e7384e23ef90c47289ac2ca625479ac19014ed81fff94ff980bd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but
MAL-2026-17280
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17280
@hrmony/pladddform-testing
Source reference: /affected/0/package/name
- Affected versions
- 40.14.3
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@hrmony/pladddform-testing",
"purl": "pkg:npm/%40hrmony/pladddform-testing",
"ecosystem": "npm"
},
"versions": [
"40.14.3"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@hrmony/pladddform-testing/MAL-2026-17280.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "15b1868642fb0421159f75ab8bbba1079036d1473948addc3f9c63842f4e4edea61bcd",
"sha256": "8e53988d86e7e4e53156998ba883b24a07ad6877066157db9e1cf97a8b435b96"
},
{
"path": "package.json",
"tlsh": "42e020108431557349c561a71c9dc457b7728f57940c3c0c33ef541c865d9b754fd76a",
"sha256": "5ef642b5b766c1d9d79f1fbf2be19a91d28fa6fb7b6879500c8db2328668a795"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "d17815e887ff8f77221054415466417dcbae5acb",
"sha512_sri": "sha512-e9CjC0lhENvXHbDDtAbYM+dFlTQ8bLoeYDI12SNIRYOUXSTWnKj5e0fybF9wbv8wKoxhsNCI+W8o7BrGMaXoAA=="
},
"filename": "pladddform-testing-40.14.3.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #29742 · Revision 1
- Added to Heist Feed
- Publisher date