Critical Malicious Code Vulnerability in @hrmony/pladddform-codegen Package
Summary
MAL-2026-17273: Malicious code in @hrmony/pladddform-codegen (npm). Affects @hrmony/pladddform-codegen versions 49.99.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hrmony/pladddform-codegen package is an npm module that is intended for code generation. However, it has been identified as a typosquatted package, mimicking a legitimate package from the @hrmony scope. This malicious version has been designed to exploit users by embedding harmful code that compromises system security.
Vulnerability Detail
The vulnerability originates from the package's index.js file, which contains malicious code that beacons to a hardcoded external endpoint. Upon loading, it performs credential harvesting by querying the AWS instance metadata service, enumerating environment variables, and reading sensitive Kubernetes secrets. This data is then sent to the attacker's server, leading to potential full system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/pladddform-codegenIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that the package is uninstalled with the command: npm uninstall @hrmony/pladddform-codegen. Additionally, monitor your system for any unusual activity and consider using tools like Vulert to check for vulnerabilities in your project. You can use the Vulert playground at https://vulert.com/scanner to assess your application's exposure to this vulnerability without needing to sign up.
Conclusion
The @hrmony/pladddform-codegen package poses a significant security risk due to embedded malicious code that can compromise systems. Immediate action is required to remove the package and secure any exposed credentials. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for @hrmony/pladddform-codegen →
FAQ
Typosquatting is a malicious practice where attackers create a package with a name similar to a legitimate package, hoping that users will mistakenly install it.
If you have installed the @hrmony/pladddform-codegen package, your system may be compromised. Look for unusual network activity or unauthorized access to sensitive information.
Immediately remove the malicious package, rotate all secrets and keys, and monitor your system for any signs of unauthorized access.
While you can remove the malicious package, there is no guarantee that all malicious software will be removed. It is crucial to assess the extent of the compromise.
Vulert monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities, helping you maintain the security of your software.
