MAL-2026-17257 Malicious code in @hrmony/benefitverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a567d870fdf9c4fecac3e9fbb009a5b23e4450ea608d416564095680dc5bc4b2 On top-level import, the package's main module POSTs an initial identifying beacon body "c53":"hello" to the hardcoded endpoint...

MAL-2026-17271 Malicious code in @hrmony/pladddform-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6470f9f3652c9b3b65d783ca46babc5ccf24e0d8d044ca654260168e8f881e17 On module load, the package's main entry point executes three exfiltration routines that POST installer-side secrets to the hardcoded endpoint...

MAL-2026-17259 Malicious code in @hrmony/component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93efe09ed89a9899669e54f614f80d91a80c59d77e0c2a2f673f92590488804 index.js declared as the package main runs top-level async code on require/import that performs three exfiltration actions against a hardcoded attack...

MAL-2026-17273 Malicious code in @hrmony/pladddform-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f0706d7223f8a1ff87ac80c6e1e42af148214545e55acc865cce12fee7eec4 On module load, index.js unconditionally beacons to the hardcoded non-first-party endpoint...

Malicious code in @hrmony/pladddform-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f0706d7223f8a1ff87ac80c6e1e42af148214545e55acc865cce12fee7eec4 On module load, index.js unconditionally beacons to the hardcoded non-first-party endpoint...

MAL-2026-17272 Malicious code in @hrmony/pladddform-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b9c27ba35a6978a0731d77b7d5fec367f4c2a8b4acc5838588071c89886fa4 On require/import, index.js performs three attacker-benefiting actions against a hardcoded endpoint at https://hrnmn.dd.h4x.tv/. First, it POSTs an...

MAL-2026-17278 Malicious code in @hrmony/pladddform-partner-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e09dd7e6a7777c82ec319c374c862db40d6bf7210991dac9a7a250fda4a259e7 On import, index.js executes a top-level fetch that harvests cloud and container secrets from the installer host and POSTs them to the hardcoded...

MAL-2026-17280 Malicious code in @hrmony/pladddform-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...

MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17281 Malicious code in @hrmony/valuenet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...

Malicious code in @hrmony/valuenet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...

MAL-2026-17277 Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...

MAL-2026-17260 Malicious code in @hrmony/devtool-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cb569df9c47639ee0fd16c34a4ac1b97b89733b1b468389d8032087ab233b On import, index.js performs an unconditional POST beacon to https://hrnmn.dd.h4x.tv/saveinstanceinfofrompkgehrmonydevtool-configuration, then querie...

MAL-2026-17267 Malicious code in @hrmony/lohndateien (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 743e2b2a4a3cf2758e6eb457dbc47857751d31379b13a48a2da25fc23f8e9701 index.js executes on module load and performs three attacker-beneficial actions against a hardcoded remote endpoint at...

Malicious code in @hrmony/lohndateien (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 743e2b2a4a3cf2758e6eb457dbc47857751d31379b13a48a2da25fc23f8e9701 index.js executes on module load and performs three attacker-beneficial actions against a hardcoded remote endpoint at...

Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

MAL-2026-17276 Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

MAL-2026-17261 Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...