Suspicious 80% javascript Download

@hrmony/kit 1.99.0

Exfiltrates AWS credentials and secrets

“bip bop I get your sip sop”

Environment collection enters HTTP request bodyJavaScript under npm package scripts dir
SHA-2569d7a36700467c7140ba841bc839426d214f16060c8c235b534a32a85a1afbfe8
URLhttps://registry.npmmirror.com/@hrmony/kit/-/kit-1.99.0.tgz
MaleculeO₂(CaS₄)H₅(Cm₁₁Db₄F₃OsPo)Md₃(InPa₅)

Also flagged by osm (The package is an unambiguous credential-theft and cloud-metadata exfiltration tool. On import, index.js immediately POSTs a beacon to an attacker-controlled endpoint then calls `aws_get()` which syst…), osv (MAL-2026-17263: Malicious code in @hrmony/kit (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.