Critical Credential Harvesting Vulnerability in @hrmony/kit-5 Package
Summary
MAL-2026-17266: Malicious code in @hrmony/kit-5 (npm). Affects @hrmony/kit-5 versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hrmony/kit-5 package is a Node.js library available on npm, designed to provide various functionalities for developers. However, it has been identified to contain malicious code that compromises the security of systems where it is installed. This vulnerability allows unauthorized access to sensitive information, including AWS IAM credentials and Kubernetes tokens.
Vulnerability Detail
The vulnerability originates from the package's preinstall script and main entry file (index.js), which execute malicious actions upon installation. These scripts query the EC2 Instance Metadata Service (IMDSv2) for sensitive identity documents and IAM role security credentials. They also enumerate environment variables and read Kubernetes service-account tokens from the filesystem. The harvested data is sent to a hardcoded attacker-controlled server, compromising the security of the affected systems. Any system running this package is considered fully compromised, necessitating immediate action to secure sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/kit-5If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the @hrmony/kit-5 package in your projects. If it is already installed, remove it immediately using the command: npm uninstall @hrmony/kit-5. Additionally, rotate any compromised credentials and secrets stored on the affected system.
Conclusion
The @hrmony/kit-5 package contains a critical vulnerability that allows for credential harvesting, posing a severe risk to any system that has it installed. Immediate removal of the package and rotation of sensitive credentials is essential to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @hrmony/kit-5 →
FAQ
The vulnerability involves malicious code that harvests sensitive credentials and environment variables from the system.
If you have installed the @hrmony/kit-5 package, your system may be compromised. It is recommended to remove the package and rotate any sensitive credentials.
Immediately rotate all sensitive credentials and secrets, as they may have been exposed due to the malicious actions of the package.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground.
Vulert is a tool that monitors open-source vulnerabilities in your software without requiring access to the code or installation. It uses the package-lock.json file to provide real-time alerts.
