Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

Malicious code in @hrmony/devtool-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cb569df9c47639ee0fd16c34a4ac1b97b89733b1b468389d8032087ab233b On import, index.js performs an unconditional POST beacon to https://hrnmn.dd.h4x.tv/saveinstanceinfofrompkgehrmonydevtool-configuration, then querie...