@depup/aws-sdk__credential-provider-process

{"modified":"2026-08-07T17:52:50Z","published":"2026-08-07T17:24:03Z","schema_version":"1.7.4","id":"MAL-2026-13623","summary":"Malicious code in @depup/aws-sdk__credential-provider-process (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d)\n@depup/aws-sdk__credential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author, homepage, and repository metadata to present itself as a drop-in dep-bumped variant of the AWS SDK package, while shipping modified code in the credential materialization path. Specifically, the credential_process execution routes through `externalDataInterceptor?.getTokenRecord?.().exec?? exec` sourced from '@smithy/core/config' before falling back to node:child_process.exec. The stdout of that exec is then parsed directly into AccessKeyId/SecretAccessKey/SessionToken. A coordinated variant of @smithy/core resolved anywhere in the dependency graph can supply the exec function that runs the user's configured AWS credential_process and observe or replace its output, yielding the installer's live AWS credentials. The upstream AWS package invokes child_process.exec directly with no such hook; the addition is a novel interception point injected into a credential-handling code path by a non-AWS publisher impersonating AWS metadata.\n","affected":[{"package":{"ecosystem":"npm","name":"@depup/aws-sdk__credential-provider-process"},"versions":["3.972.59-depup.0","3.972.63-depup.0","3.972.66-depup.0","3.972.62-depup.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist-cjs/index.js","sha256":"459dccd69ac50b0cf33d00398dd6b18dec18521d8ed6bc359121e1a96115ea4d","tlsh":"e661c00fd5ee042b49ab3caefa8740123569e10339d98cb4b9cd520aff870a0fdd5191"},{"path":"package.json","sha256":"f78af621c9782bd8289baddccdb4fe93a2549778c6c34b9189111d366a40bb32","tlsh":"8d51ee30c8f44c2305c824e9ed78021395b56a074a647c5c73dec26c8f0e5ef66be29e"}],"package_integrity":[{"filename":"aws-sdk__credential-provider-process-3.972.59-depup.0.tgz","hashes":{"sha1":"fab9525ed82d593679db54be6e78658094bb2b69","sha512_sri":"sha512-7nSjvRg1R6kozDrbxZVGZfBixk0mtjD0KDV2OxrnmW/0grqH7MOzyaU+57CfZkCPjMeslzIDfCyOt/m8V0d5Qg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.59-depup.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.63-depup.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.66-depup.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.62-depup.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017128","import_time":"2026-08-07T17:51:00.016816992Z","modified_time":"2026-08-07T17:24:30Z","sha256":"1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d","source":"amazon-inspector","versions":["3.972.59-depup.0"]},{"id":"IN-MAL-2026-017126","import_time":"2026-08-07T17:50:59.945452117Z","modified_time":"2026-08-07T17:24:11Z","sha256":"d1fb63dd369be0dcaf7c739df57eaf224c8188df72e70368e372dcdd7a55ce40","source":"amazon-inspector","versions":["3.972.63-depup.0"]},{"id":"IN-MAL-2026-017130","import_time":"2026-08-07T17:51:00.117447566Z","modified_time":"2026-08-07T17:24:50Z","sha256":"e3ef5ef2eb22c05e4a1679e049be8bf2cbde2a0804d7b8126a8ae07454bccc21","source":"amazon-inspector","versions":["3.972.66-depup.0"]},{"id":"IN-MAL-2026-017125","import_time":"2026-08-07T17:50:59.888241208Z","modified_time":"2026-08-07T17:24:03Z","sha256":"ee20262f81319e7c621c0c20558b2fb37a034ca33b9be18afea18bd1e9f60bfe","source":"amazon-inspector","versions":["3.972.62-depup.0"]}]}}