{"id":"MAL-2026-17263","revision":"d75bcd785a404f31ae2ef5d4bfcba83a","records":[{"revision":"d75bcd785a404f31ae2ef5d4bfcba83a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17263","aliases":[],"title":"Malicious code in @hrmony/kit (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d)\nOn require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role security-credentials (including temporary AWS access key, secret, and session token), enumerates every entry in process.env, and recursively reads /var/run/secrets/ (Kubernetes projected service-account tokens and mounted secrets). The collected data is POSTed to the hardcoded endpoint https://hrnmn.dd.h4x.tv/save_instance_info_index. package.json also declares a preinstall hook (node scripts/check_setup.mjs) intended to run a sibling variant of the same payload (scripts/check-setup.mjs) that exfiltrates to https://hrnmn.dd.h4x.tv/save_instance_info_hook; a filename hyphen/underscore mismatch appears to prevent that lifecycle path from firing, but the payload is present in the tarball. The package exports no functional API — index.js contains only the exfiltration code, and package.json metadata (description 'bip bop I get your sip sop', author 'kuhuna') is a cover story. The.h4x.tv destination is unrelated to any legitimate publisher.\n","state":0,"publishedAt":"2026-09-29T16:34:55+00:00","modifiedAt":"2026-09-29T17:00:07.2495673+00:00","affected":[{"ecosystem":"npm","name":"@hrmony/kit","ranges":[],"versions":["1.99.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@hrmony/kit/v/1.99.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17263","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17263","identifiers":["MAL-2026-17263"]},"retained":false,"historicalAffected":[]}],"coverage":[]}