GCVE-110-OSM-2026-12732

The package is an unambiguous credential-theft and cloud-metadata exfiltration tool. On import, index.js immediately POSTs a beacon to an attacker-controlled endpoint then calls `aws_get()` which systematically harvests AWS IMDSv2 tokens, IAM role credentials, EC2 identity documents, and network interface details — all POSTed to the same exfil URL. The `local_get()` function enumerates all `process.env` variables and recursively reads Kubernetes secrets from `/var/run/secrets/`, exfiltrating them to the same endpoint. The dependency `@hrmony/kit-5` is itself flagged as known malicious, indicating a coordinated campaign under the `@hrmony` scope. ENTRY index.js (main: index.js) DESTINATION - 14 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) OBFUSCATION - recovered 9 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.js: "http://169.254.169.254/latest/meta-data" PAYLOAD FILES index.js