Critical Malicious Code Vulnerability in @hrmony/pladddform-infrastructure Package
Summary
MAL-2026-17277: Malicious code in @hrmony/pladddform-infrastructure (npm). Affects @hrmony/pladddform-infrastructure versions 40.14.3 – 40.99.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @hrmony/pladddform-infrastructure package is an npm library that is designed to facilitate infrastructure management for applications. However, it has been found to contain malicious code that compromises the security of systems using it. This package mimics legitimate internal infrastructure packages, making it a target for dependency confusion attacks.
Vulnerability Detail
The vulnerability originates from the package's top-level code, which executes a POST request to a hardcoded attacker endpoint upon any require or import of the package. This malicious behavior allows the attacker to collect sensitive information, including AWS instance metadata and IAM role credentials. Additionally, the package serializes environment variables and Kubernetes secrets, sending this data to the attacker's server. The presence of this code means that any system using this package is at risk of being fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/pladddform-infrastructureIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can isolate the affected environment and restrict network access to prevent the malicious code from communicating with the attacker's server. However, this does not eliminate the risk, and complete removal of the package is recommended.
Conclusion
The @hrmony/pladddform-infrastructure package contains critical malicious code that poses significant security risks. Immediate action is required to remove the package and secure any exposed credentials. Regular monitoring and auditing of dependencies are essential to maintain a secure environment.
See every vulnerability recorded for @hrmony/pladddform-infrastructure →
FAQ
Immediately remove the @hrmony/pladddform-infrastructure package and rotate any secrets or keys that may have been exposed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Leaving this package installed can lead to full compromise of your system, exposing sensitive information and credentials to attackers.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and avoid using packages with suspicious names or origins.
Caution is advised. Review other packages from the same author and assess their security before use, as they may also contain malicious code.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
