{"items":[{"id":"NVI-00010815","kind":"supply_chain_event","title":"Malicious code in @hrmony/kit-4 (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xv63-6pmj-vwfh"],"plain_summary":"GitHub lists this malware advisory for @hrmony/kit-4. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-16f2c87652252ee45cdea8c4fa871f8f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-16f2c87652252ee45cdea8c4fa871f8f","url":"https://github.com/advisories/GHSA-xv63-6pmj-vwfh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xv63-6pmj-vwfh","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:53.199Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-16f2c87652252ee45cdea8c4fa871f8f"],"technology":"@hrmony/kit-4","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853)\nThe package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the AWS EC2 instance metadata service (IMDSv2 at 169.254.169.254) to retrieve the host's IAM role credentials, enumerates the full process.env, and recursively reads /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets), then POSTs the collected data to https://hrnmn.dd.h4x.tv/save_instance_info_hook. The package main (index.js) contains the same collector and executes it via top-level await on require/import, POSTing to https://hrnmn.dd.h4x.tv/save_instance_info_index. Both entrypoints unconditionally beacon to hrnmn.dd.h4x.tv before credential collection. The destination is a hardcoded non-first-party host on the h4x.tv TLD, unrelated to any declared publisher domain. Installing or importing this package on an EC2 host or in a Kubernetes pod yields AWS IAM role credentials and cluster service-account tokens to the operator of hrnmn.dd.h4x.tv.\n\n---\n\nCredit: OpenSSF ([source](http","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T23:18:22.389Z","source_updated_at":"2026-09-29T18:31:45.000Z","source_disclosed_at":"2026-09-29T18:31:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:53.199Z"}],"next_cursor":null,"snapshot_revision":"42594"}