Supply chain · npm · High

Critical Malicious npm Package '@hrmony/kit-4' Steals Credentials

Threat Engine Auto-Feed · data current as of 2026-09-29

The npm package '@hrmony/kit-4' version 1.0.0 contains malicious code designed to harvest credentials and secrets from compromised systems. It poses a critical supply-chain risk, particularly for environments like AWS EC2 and Kubernetes, by exfiltrating sensitive information to an external server.

  • Package: npm / @hrmony/kit-4
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package '@hrmony/kit-4' version 1.0.0 includes credential-harvesting code that activates both during installation and when the package is imported. This code attempts to retrieve AWS IAM role credentials, enumerate environment variables, and read Kubernetes service-account tokens and mounted secrets, then exfiltrates this data to a hardcoded external domain.

How the attack works

This is a malicious package injection attack. The attacker published a package to the npm registry that, when installed or imported, executes code to collect sensitive information from the host system. This information is then sent to an attacker-controlled server. The attack leverages hooks that run during package lifecycle events (install, import) to achieve persistence and data exfiltration.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm packages, especially if they use the affected package
  • Organizations deploying applications on AWS EC2 instances or Kubernetes clusters that depend on npm packages

Conditions that increase exposure

  • Direct or transitive dependency on '@hrmony/kit-4' version 1.0.0
  • Lack of package lockfiles or unpinned dependency versions, allowing malicious versions to be pulled
  • CI/CD environments with broad network access or elevated permissions
  • Use of internal package mirrors that may not filter malicious packages

Blast-radius scenarios

  • An attacker gains AWS IAM role credentials, potentially leading to unauthorized access to cloud resources.
  • An attacker obtains Kubernetes service-account tokens and mounted secrets, enabling lateral movement and control within the cluster.
  • Sensitive environment variables are exfiltrated, potentially exposing API keys, database credentials, or other secrets.
  • The blast radius includes any system where the package is installed or imported, particularly those with access to cloud metadata services or Kubernetes secrets.

What to do (defensive)

Detect

  • Scan dependency trees for '@hrmony/kit-4' version 1.0.0.
  • Monitor network traffic for connections to 'hrnmn.dd.h4x.tv' from build systems or runtime environments.
  • Review package integrity using checksums or signatures if available.
  • Implement runtime monitoring for unexpected process execution or file access patterns by npm packages.

Contain

  • Immediately quarantine any systems or build environments found to have installed or imported '@hrmony/kit-4' version 1.0.0.
  • Block network access to 'hrnmn.dd.h4x.tv' at the perimeter and host level.
  • Revoke and rotate all AWS IAM credentials and Kubernetes service-account tokens that could have been exposed on affected systems.
  • Isolate affected CI/CD pipelines and review their configurations and permissions.

Remediate

  • Remove '@hrmony/kit-4' version 1.0.0 from all dependency lists and package lockfiles.
  • Rebuild affected applications and redeploy them to clean environments.
  • Implement strict dependency pinning and use lockfiles (e.g., package-lock.json) to prevent unexpected package updates.
  • Enhance supply chain security practices, including package integrity checks and source code reviews for critical dependencies.

Frontier verdict — High

Prioritize immediate detection and removal of '@hrmony/kit-4' version 1.0.0 due to critical credential theft capabilities impacting AWS and Kubernetes environments.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.