Critical Malicious Code Vulnerability in @hrmony/hyper-json-builder Package
Summary
MAL-2026-17282: Malicious code in @hrmony/hyper-json-builder (npm). Affects @hrmony/hyper-json-builder versions 1.99.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hrmony/hyper-json-builder package is an npm module designed for building JSON structures in a hyper-efficient manner. It is commonly used in various applications for its simplicity and performance. However, this package has been found to contain malicious code that poses significant security risks to any system where it is installed.
Vulnerability Detail
The vulnerability originates from a malicious code embedded in the package's index.js file. Upon loading the module, it performs a fetch to a hardcoded attacker-controlled endpoint, triggering credential-harvesting routines. It enumerates environment variables and reads Kubernetes secrets, sending sensitive information to the attacker's server. Additionally, it retrieves AWS EC2 instance metadata, including IAM role credentials, further compromising the system. This vulnerability allows attackers to gain full control over the affected systems, leading to potential data breaches and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/hyper-json-builderIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider isolating the environment where this package is used. You can also monitor your environment variables and Kubernetes secrets for any unauthorized access or changes. However, the best course of action is to remove the package entirely.
Conclusion
The @hrmony/hyper-json-builder package contains a critical vulnerability that allows attackers to harvest sensitive information and gain control over affected systems. Immediate removal of the package is necessary to protect your environment. Utilize tools like Vulert to monitor for vulnerabilities and keep your dependencies secure.
See every vulnerability recorded for @hrmony/hyper-json-builder →
FAQ
You should remove the package immediately and rotate any secrets or keys that may have been exposed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, complete system compromise, and potential data breaches.
The only effective mitigation is to remove the package entirely. There are no safe workarounds due to the nature of the malicious code.
Regularly check for updates to your packages and use tools like Vulert to monitor your dependencies for known vulnerabilities.
