Credential Harvesting Vulnerability in @hrmony/kit-4 Package
Summary
MAL-2026-17265: Malicious code in @hrmony/kit-4 (npm). Affects @hrmony/kit-4 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hrmony/kit-4 package is an npm library designed for various functionalities within JavaScript applications. However, it has been identified to contain malicious code that poses significant security risks. This package executes credential-harvesting scripts during both installation and import, making it particularly dangerous for users operating in cloud environments such as AWS EC2 or Kubernetes.
Vulnerability Detail
The vulnerability originates from malicious code embedded in the @hrmony/kit-4 package. It runs credential-harvesting scripts that query the AWS EC2 instance metadata service to retrieve IAM role credentials and reads sensitive Kubernetes service-account tokens. This data is then sent to a hardcoded external server (hrnmn.dd.h4x.tv), exposing sensitive information to unauthorized parties. The vulnerability affects any environment where the package is installed or imported, leading to potential data breaches and unauthorized access to cloud resources.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/kit-4If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the @hrmony/kit-4 package in your applications. If you must use it, consider isolating it in a controlled environment where sensitive data is not accessible.
Conclusion
The @hrmony/kit-4 package contains serious vulnerabilities that can lead to credential theft and unauthorized access to sensitive information. It is crucial to remove this package from your projects and monitor your environments for any signs of compromise. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for @hrmony/kit-4 →
FAQ
The vulnerability involves malicious code that collects and transmits sensitive credentials to an external server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
Immediately remove the @hrmony/kit-4 package from your project and monitor your environment for any unauthorized access.
As of now, there is no safe version available. It is recommended to avoid using this package until a secure version is released.
Vulert uses your package-lock.json to monitor and alert in real-time for open-source vulnerabilities, ensuring you stay informed about potential risks.
