aws-sdk-v4

{"modified":"2026-08-05T15:31:41Z","published":"2026-08-05T15:31:41Z","schema_version":"1.7.4","id":"MAL-2026-13218","summary":"Malicious code in aws-sdk-v4 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7)\nPackage aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require() of index.js, JSON-stringifies process.env together with hostname, username, home directory, platform, and current working directory, base64-encodes the blob, and sends it as a Telegram Bot API sendMessage request to a hardcoded bot token and chat_id 8969499041 at api.telegram.org. A temporary flag file gates repeat executions. Any secrets present in the installer's environment (CI tokens, cloud credentials, API keys) are transmitted to the attacker on first import. The package additionally exposes wallet-shaped functions (createWallet, signTransaction, generateMnemonic) inconsistent with its advertised AWS SDK purpose, reinforcing the deceptive-naming delivery vector.\n","affected":[{"package":{"ecosystem":"npm","name":"aws-sdk-v4"},"versions":["3.650.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"cb3cd182f928efc01c01d28cc052f3a55eb065b394d6df0463311dcd522275fc","tlsh":"bd2186c837f1f99d12336542646f350ab2bfc6e54448fa58d0a4d1c72f342cc4955398"},{"path":"package.json","sha256":"ecb1ea82c09b4083020d82dd5971dc4a8109c4fd45ae5f5fd86530ce5bc0c227","tlsh":"44f0c071c96459f31bc822825c3a415272932d1b8504bc0c33d3421c879cbbf10fd65c"}],"package_integrity":[{"filename":"aws-sdk-v4-3.650.0.tgz","hashes":{"sha1":"0288c6f2233800d346ffa7de241de6afe77aca15","sha512_sri":"sha512-N9Pa+iBbbee1V4X2gOduNRheM5zEfdYGjN08g6D7IJ1N8H82/yi30Iv8+k5wuGNUWFxnUi9ntPO4swXQ/YvqhQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/aws-sdk-v4/v/3.650.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015733","import_time":"2026-08-05T16:13:37.738748771Z","modified_time":"2026-08-05T15:31:41Z","sha256":"3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7","source":"amazon-inspector","versions":["3.650.0"]}]}}