Critical Malicious Code Vulnerability in @hrmony/belegerfassung-pladddform Package
Summary
MAL-2026-17252: Malicious code in @hrmony/belegerfassung-pladddform (npm). Affects @hrmony/belegerfassung-pladddform versions 1.99.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hrmony/belegerfassung-pladddform package is an npm module that is intended for form handling. However, it has been identified as a malicious package that executes harmful code upon import. This package uses a typosquat pattern to deceive users into installing it, posing significant security risks.
Vulnerability Detail
The vulnerability originates from the package's main module (index.js), which executes exfiltration logic at the top level upon import. It sends a beacon to a hardcoded endpoint and queries the AWS EC2 Instance Metadata Service to harvest sensitive information such as AMI ID, instance identity, IAM role names, and security credentials. Additionally, it enumerates environment variables and reads files from the Kubernetes secrets directory, sending all collected data to the same malicious endpoint. This vulnerability can lead to complete compromise of any system running this package, necessitating immediate action to secure any exposed secrets.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/belegerfassung-pladddformIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that any systems running this package are isolated from sensitive data and consider rotating all secrets and keys stored on those systems. It is also advisable to monitor network traffic for any suspicious activity.
Conclusion
The @hrmony/belegerfassung-pladddform package contains a critical vulnerability that executes malicious code, compromising any system that installs it. Immediate removal of the package and rotation of any exposed secrets is essential to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @hrmony/belegerfassung-pladddform →
FAQ
Immediately remove the @hrmony/belegerfassung-pladddform package and rotate any secrets or keys that may have been exposed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Failure to address this vulnerability can lead to complete system compromise, exposing sensitive information and potentially allowing unauthorized access to your infrastructure.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and avoid installing packages from untrusted sources.
Typosquatting is a technique used by malicious actors to create packages with names similar to legitimate ones, tricking users into installing them. This vulnerability uses a typosquat pattern to deceive users.
