{"id":"MAL-2026-4508","summary":"Malicious code in cdk-insights (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89)\nThe package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `writeFileSync` operations — the canonical wormable auto-publication pattern (enumerate maintainer's other packages, rewrite their package.json, republish under the installer's npm credentials). Additionally, dist/aspects/CdkInsightsAspect.js, dist/entry.js, and dist/index.js contain multiple HTTP POST sinks consistent with hardcoded C2 / data-exfiltration endpoints, and CdkInsightsAspect.js contains `ping`-based network reconnaissance. The combination of wormable self-propagation infrastructure plus exfiltration POST endpoints in install/import-reachable code is unambiguous supply-chain attack shape: any developer or CI system installing this package risks (a) having installer-side data POSTed to attacker-controlled endpoints and (b) having their npm credentials abused to republish malicious versions of their other packages.\n","modified":"2026-05-26T06:02:17.575322638Z","published":"2026-05-22T16:27:47Z","database_specific":{"malicious-packages-origins":[{"sha256":"fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89","import_time":"2026-05-26T05:52:11.522743274Z","versions":["1.41.2"],"id":"IN-MAL-2026-004226","source":"amazon-inspector","modified_time":"2026-05-22T16:27:47Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cdk-insights/v/1.41.2"}],"affected":[{"package":{"name":"cdk-insights","ecosystem":"npm","purl":"pkg:npm/cdk-insights"},"versions":["1.41.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cdk-insights/MAL-2026-4508.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-uqeMBpmTDCoLS+P1ImVO/At+ngz+an3zY06EvkPasRJ47haGGb+jb8wlt5LoXPLE6ryZGycNb/87XWssfoxx1A==","sha1":"0d4788d6776b48c12b3cd6b72d4bd629f19e9ae8"},"filename":"cdk-insights-1.41.2.tgz"}],"evidence_files":[{"sha256":"67f6ebad26b822c05d5ff5ca4f5033a5e403dd1cb34f725042d0b7d1b17ed8a1","tlsh":"19f33ac5b755a411439e005a14fd4002f7baee98412960acf3aed6dfb6ccc4966bbb33","path":"dist/aspects/CdkInsightsAspect.js"},{"sha256":"01ff71d3d17a49da98445a5d6b76d453775afaf89fc99d57d6118fe6bb921461","tlsh":"2a854abf674226321fe710e9dc66010ae5a9ae0c8485953af2fce497735185cd2e3f39","path":"dist/entry.js"},{"sha256":"0c9a3d2227e9886b746ae0b25ab377f0ff61aecc62bdfaacbf0f2b8a5d7ecd72","tlsh":"581519f76b0636364fa7107aea5a5102f2b56908d8d8541cf6c8d14e3395c3c62e3fba","path":"dist/index.js"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}