@hrmony/kit

GHSA-jj87-9224-r2cj

Malicious code in @hrmony/kit (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.99.0`

## Source: amazon-inspector (6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d)
On require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role security-credentials (including temporary AWS access key, secret, and session token), enumerates every entry in process.env, and recursively reads /var/run/secrets/ (Kubernetes projected service-account tokens and mounted secrets). The collected data is POSTed to the hardcoded endpoint https://hrnmn.dd.h4x.tv/save_instance_info_index. package.json also declares a preinstall hook (node scripts/check_setup.mjs) intended to run a sibling variant of the same payload (scripts/check-setup.mjs) that exfiltrates to https://hrnmn.dd.h4x.tv/save_instance_info_hook; a filename hyphen/underscore mismatch appears to prevent that lifecycle path from firing, but the payload is present in the tarball. The package exports no functional API — index.js contains only the exfiltration code, and package.json metadata (description 'bip bop I get your sip sop', author 'kuhuna') is a cover story. The.h4x.tv destination is unrelated to any legitimate publisher.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b1fa18dbdeb2a848cee9a5381096294c875143e0/osv/malicious/npm/@hrmony/kit/MAL-2026-17263.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b1fa18dbdeb2a848cee9a5381096294c875143e0/osv/malicious/npm/@hrmony/kit/MAL-2026-17263.json
- https://www.npmjs.com/package/@hrmony/kit/v/1.99.0
- https://github.com/advisories/GHSA-jj87-9224-r2cj

Compromised versions (1)

= 1.99.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.