Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

Malicious code in @hrmony/devtool-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cb569df9c47639ee0fd16c34a4ac1b97b89733b1b468389d8032087ab233b On import, index.js performs an unconditional POST beacon to https://hrnmn.dd.h4x.tv/saveinstanceinfofrompkgehrmonydevtool-configuration, then querie...

MAL-2026-17276 Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

MAL-2026-17275 Malicious code in @hrmony/pladddform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605 On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 IMDSv2, retrieves the instance identity document,...