MAL-2026-13218

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aws-sdk-v4/MAL-2026-13218.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13218
Published
2026-08-05T15:31:41Z
Modified
2026-08-05T16:49:57.089147865Z
Summary
Malicious code in aws-sdk-v4 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7)

Package aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require() of index.js, JSON-stringifies process.env together with hostname, username, home directory, platform, and current working directory, base64-encodes the blob, and sends it as a Telegram Bot API sendMessage request to a hardcoded bot token and chat_id 8969499041 at api.telegram.org. A temporary flag file gates repeat executions. Any secrets present in the installer's environment (CI tokens, cloud credentials, API keys) are transmitted to the attacker on first import. The package additionally exposes wallet-shaped functions (createWallet, signTransaction, generateMnemonic) inconsistent with its advertised AWS SDK purpose, reinforcing the deceptive-naming delivery vector.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7",
            "id": "IN-MAL-2026-015733",
            "modified_time": "2026-08-05T15:31:41Z",
            "import_time": "2026-08-05T16:13:37.738748771Z",
            "source": "amazon-inspector",
            "versions": [
                "3.650.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / aws-sdk-v4

Package

Name
aws-sdk-v4
View open source insights on deps.dev
Purl
pkg:npm/aws-sdk-v4

Affected ranges

Affected versions

3.*
3.650.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "cb3cd182f928efc01c01d28cc052f3a55eb065b394d6df0463311dcd522275fc",
            "path": "index.js",
            "tlsh": "bd2186c837f1f99d12336542646f350ab2bfc6e54448fa58d0a4d1c72f342cc4955398"
        },
        {
            "sha256": "ecb1ea82c09b4083020d82dd5971dc4a8109c4fd45ae5f5fd86530ce5bc0c227",
            "path": "package.json",
            "tlsh": "44f0c071c96459f31bc822825c3a415272932d1b8504bc0c33d3421c879cbbf10fd65c"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-N9Pa+iBbbee1V4X2gOduNRheM5zEfdYGjN08g6D7IJ1N8H82/yi30Iv8+k5wuGNUWFxnUi9ntPO4swXQ/YvqhQ==",
                "sha1": "0288c6f2233800d346ffa7de241de6afe77aca15"
            },
            "filename": "aws-sdk-v4-3.650.0.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aws-sdk-v4/MAL-2026-13218.json"