cdk-insights

{"schema_version":"1.7.4","id":"MAL-2026-4508","published":"2026-05-22T16:27:47Z","modified":"2026-08-05T19:07:43.211084357Z","summary":"Malicious code in cdk-insights (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89)\nThe package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `writeFileSync` operations — the canonical wormable auto-publication pattern (enumerate maintainer's other packages, rewrite their package.json, republish under the installer's npm credentials). Additionally, dist/aspects/CdkInsightsAspect.js, dist/entry.js, and dist/index.js contain multiple HTTP POST sinks consistent with hardcoded C2 / data-exfiltration endpoints, and CdkInsightsAspect.js contains `ping`-based network reconnaissance. The combination of wormable self-propagation infrastructure plus exfiltration POST endpoints in install/import-reachable code is unambiguous supply-chain attack shape: any developer or CI system installing this package risks (a) having installer-side data POSTed to attacker-controlled endpoints and (b) having their npm credentials abused to republish malicious versions of their other packages.\n","affected":[{"package":{"name":"cdk-insights","ecosystem":"npm"},"versions":["1.41.2","1.42.3","1.59.3","1.60.0","1.58.1","1.61.0","1.59.2","1.60.1","1.59.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/aspects/CdkInsightsAspect.js","sha256":"67f6ebad26b822c05d5ff5ca4f5033a5e403dd1cb34f725042d0b7d1b17ed8a1","tlsh":"19f33ac5b755a411439e005a14fd4002f7baee98412960acf3aed6dfb6ccc4966bbb33"},{"path":"dist/entry.js","sha256":"01ff71d3d17a49da98445a5d6b76d453775afaf89fc99d57d6118fe6bb921461","tlsh":"2a854abf674226321fe710e9dc66010ae5a9ae0c8485953af2fce497735185cd2e3f39"},{"path":"dist/index.js","sha256":"0c9a3d2227e9886b746ae0b25ab377f0ff61aecc62bdfaacbf0f2b8a5d7ecd72","tlsh":"581519f76b0636364fa7107aea5a5102f2b56908d8d8541cf6c8d14e3395c3c62e3fba"}],"package_integrity":[{"filename":"cdk-insights-1.41.2.tgz","hashes":{"sha1":"0d4788d6776b48c12b3cd6b72d4bd629f19e9ae8","sha512_sri":"sha512-uqeMBpmTDCoLS+P1ImVO/At+ngz+an3zY06EvkPasRJ47haGGb+jb8wlt5LoXPLE6ryZGycNb/87XWssfoxx1A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.41.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.42.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.59.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.60.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.58.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.61.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.59.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.60.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.59.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004226","import_time":"2026-05-26T05:52:11.522743274Z","modified_time":"2026-05-22T16:27:47Z","sha256":"fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89","source":"amazon-inspector","versions":["1.41.2"]},{"id":"IN-MAL-2026-005797","import_time":"2026-06-12T19:43:34.547542902Z","modified_time":"2026-06-12T19:02:06Z","sha256":"c881a135de8104d4fb3610e23f98105d97692a8c20b0cad8fb4a45c3d2052e46","source":"amazon-inspector","versions":["1.42.3"]},{"id":"IN-MAL-2026-015855","import_time":"2026-08-05T19:04:54.879064369Z","modified_time":"2026-08-05T18:24:43Z","sha256":"3fb8a2596514db602ed5af1cac685860d88c6c3448c25948c09f0f4b97898b6e","source":"amazon-inspector","versions":["1.59.3"]},{"id":"IN-MAL-2026-015856","import_time":"2026-08-05T19:04:54.960702391Z","modified_time":"2026-08-05T18:24:51Z","sha256":"5730037847698ac25c003e2d24da69fd5ce0beb152e533893c88bd412b449cb7","source":"amazon-inspector","versions":["1.60.0"]},{"id":"IN-MAL-2026-015850","import_time":"2026-08-05T19:04:54.479814336Z","modified_time":"2026-08-05T18:23:57Z","sha256":"67e86d39ceb7e95b87534fab89130689e1a42af6e9cff001b0a7531290d0903d","source":"amazon-inspector","versions":["1.58.1"]},{"id":"IN-MAL-2026-015852","import_time":"2026-08-05T19:04:54.603206674Z","modified_time":"2026-08-05T18:24:16Z","sha256":"c467b32fdf460bd9e202e144cd9b24a3102eda19b31b5bfb6fdd1d6d111a660f","source":"amazon-inspector","versions":["1.61.0"]},{"id":"IN-MAL-2026-015854","import_time":"2026-08-05T19:04:54.795884168Z","modified_time":"2026-08-05T18:24:35Z","sha256":"c8f0c46cdceec9c6b8fc25872476957e07206a18a14fd6e11716cfb2971809e7","source":"amazon-inspector","versions":["1.59.2"]},{"id":"IN-MAL-2026-015853","import_time":"2026-08-05T19:04:54.725126008Z","modified_time":"2026-08-05T18:24:27Z","sha256":"f9db10400f950d9a0be522d74238a65a57bd1655b09cc5f1ca6cfaac49c2e421","source":"amazon-inspector","versions":["1.60.1"]},{"id":"IN-MAL-2026-015851","import_time":"2026-08-05T19:04:54.544142084Z","modified_time":"2026-08-05T18:24:08Z","sha256":"27fad94be236f6496d94f6bdbbfe141acec977e9d2ede163be9c95a41c294803","source":"amazon-inspector","versions":["1.59.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}