Critical Malicious Code Vulnerability in @hrmony/pladddform-partner-registry Package
Summary
MAL-2026-17278: Malicious code in @hrmony/pladddform-partner-registry (npm). Affects @hrmony/pladddform-partner-registry versions 40.14.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hrmony/pladddform-partner-registry package is an npm module that appears to be a part of a coordinated typosquat and dependency confusion campaign. It is designed to harvest sensitive information from the host machine upon import. The package does not provide any legitimate functionality and is solely focused on exfiltrating credentials and secrets.
Vulnerability Detail
This vulnerability originates from the package's malicious code, which executes a top-level fetch on import. It collects cloud and container secrets from the host, including AWS EC2 instance metadata, IAM role names, temporary security credentials, and Kubernetes service-account tokens. The collected data is sent to a hardcoded attacker-controlled endpoint, compromising the security of any system running this package. The package's design and behavior indicate a deliberate attempt to exploit users through credential theft.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @hrmony/pladddform-partner-registryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. Ensure that you rotate any secrets or keys that may have been exposed due to the installation of this package.
Conclusion
The @hrmony/pladddform-partner-registry package contains malicious code that compromises the security of any system it is installed on. Immediate action is required to remove the package and secure any exposed credentials. Regular monitoring and auditing of dependencies are essential to prevent similar vulnerabilities in the future.
See every vulnerability recorded for @hrmony/pladddform-partner-registry →
FAQ
Immediately uninstall the package and rotate any secrets or credentials that may have been exposed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Keeping this package installed poses a significant risk as it can lead to credential theft and full compromise of your system.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your open-source packages.
Typosquatting is a technique used by attackers to create malicious packages with names similar to legitimate ones. This vulnerability is a result of such a campaign, exploiting users who may mistakenly install the malicious package.
