Critical Malicious Code Vulnerability in @hrmony/benefit-sachbezug Package
Summary
MAL-2026-17256: Malicious code in @hrmony/benefit-sachbezug (npm). Affects @hrmony/benefit-sachbezug versions 1.99.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hrmony/benefit-sachbezug package is an npm library that is designed to provide specific functionalities related to benefits management. However, it has been found to contain malicious code that compromises the security of systems using it. The package has an empty description and is licensed under ISC, which raises concerns about its legitimacy and safety.
Vulnerability Detail
The vulnerability originates from the package's main entry file (index.js), which executes malicious code at require/import time. It POSTs sensitive data to a hardcoded endpoint, including AWS EC2 Instance Metadata, IAM role temporary credentials, and Kubernetes secrets. This behavior indicates a severe security risk, as any system running this package can be fully compromised, leading to unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/benefit-sachbezugIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily isolate your application from the affected package by removing it from your dependencies and replacing its functionality with a secure alternative until a patch is released.
Conclusion
The @hrmony/benefit-sachbezug package contains a critical vulnerability that can lead to severe security risks. Immediate action is required to remove the package and secure your systems. Regularly monitoring for vulnerabilities and keeping packages updated is essential for maintaining a secure software environment.
See every vulnerability recorded for @hrmony/benefit-sachbezug →
FAQ
You should immediately remove the package from your project and consider rotating any secrets or keys that may have been exposed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
Failing to address this vulnerability can lead to full system compromise, unauthorized access to sensitive data, and potential data breaches.
Yes, you can isolate your application from the affected package and replace its functionality with a secure alternative.
Keeping packages updated is crucial for maintaining security, as updates often include patches for vulnerabilities that could be exploited by attackers.
