MAL-2026-17251 Malicious code in @hrmony/app-gateway-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d3f05113dd7daa9fac2da8187afecc751fafcf96449e7f4eb4a5d9a4878844 On require/import of @hrmony/app-gateway-templates, index.js the package main executes an exfiltration routine against a hardcoded attacker endpoint ...

MAL-2026-17262 Malicious code in @hrmony/interfaces (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7837cf2dff543cfea2f35e0dea5f767ca7b8e8f81129f4c770e5693ed247c0e index.js executes top-level async code on any require/import of the package. The code 1 obtains an AWS IMDSv2 token and fetches EC2 instance identity...

MAL-2026-17254 Malicious code in @hrmony/benefit-internetzuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209d5855ea7b92261c91e4f405f0306f268bb92b9ca8f888bfec4d0a84053544 On module import, the package unconditionally beacons to the hardcoded external host...

Malicious code in @hrmony/benefit-internetzuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209d5855ea7b92261c91e4f405f0306f268bb92b9ca8f888bfec4d0a84053544 On module import, the package unconditionally beacons to the hardcoded external host...

MAL-2026-17258 Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

MAL-2026-17256 Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

Malicious code in @hrmony/benefitverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a567d870fdf9c4fecac3e9fbb009a5b23e4450ea608d416564095680dc5bc4b2 On top-level import, the package's main module POSTs an initial identifying beacon body "c53":"hello" to the hardcoded endpoint...

MAL-2026-17257 Malicious code in @hrmony/benefitverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a567d870fdf9c4fecac3e9fbb009a5b23e4450ea608d416564095680dc5bc4b2 On top-level import, the package's main module POSTs an initial identifying beacon body "c53":"hello" to the hardcoded endpoint...

Malicious code in @hrmony/pladddform-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6470f9f3652c9b3b65d783ca46babc5ccf24e0d8d044ca654260168e8f881e17 On module load, the package's main entry point executes three exfiltration routines that POST installer-side secrets to the hardcoded endpoint...

MAL-2026-17269 Malicious code in @hrmony/middlewares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2129e9ecca729ffb0ac23ee07dd5be18f2a853560899599981bc92b19dda4363 On module load, the package queries the AWS instance metadata service at 169.254.169.254 IMDSv2 to enumerate instance identity, region, and network...

Malicious code in @hrmony/middlewares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2129e9ecca729ffb0ac23ee07dd5be18f2a853560899599981bc92b19dda4363 On module load, the package queries the AWS instance metadata service at 169.254.169.254 IMDSv2 to enumerate instance identity, region, and network...

Malicious code in @hrmony/component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93efe09ed89a9899669e54f614f80d91a80c59d77e0c2a2f673f92590488804 index.js declared as the package main runs top-level async code on require/import that performs three exfiltration actions against a hardcoded attack...

MAL-2026-17259 Malicious code in @hrmony/component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93efe09ed89a9899669e54f614f80d91a80c59d77e0c2a2f673f92590488804 index.js declared as the package main runs top-level async code on require/import that performs three exfiltration actions against a hardcoded attack...

Malicious code in @hrmony/pladddform-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de81847796671c2a5e9f97a94fae50352b0dff0816e4f0a7dfaf707fbb92629 index.js executes at module top level on require/import. It performs an unconditional POST check-in to...

MAL-2026-17274 Malicious code in @hrmony/pladddform-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de81847796671c2a5e9f97a94fae50352b0dff0816e4f0a7dfaf707fbb92629 index.js executes at module top level on require/import. It performs an unconditional POST check-in to...

MAL-2026-17279 Malicious code in @hrmony/pladddform-shared-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89319d39ad6d753459be90c221d657a73f70955c63d1675b347c11b5743209cc On module import, index.js executes three exfiltration routines that POST harvested secrets to the hardcoded endpoint...

Malicious code in @hrmony/pladddform-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...

MAL-2026-17281 Malicious code in @hrmony/valuenet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...

Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...