MAL-2026-13623

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@depup/aws-sdk__credential-provider-process/MAL-2026-13623.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13623
Published
2026-08-07T17:24:03Z
Modified
2026-08-07T18:05:11Z
Summary
Malicious code in @depup/aws-sdk__credential-provider-process (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d)

@depup/aws-sdk__credential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author, homepage, and repository metadata to present itself as a drop-in dep-bumped variant of the AWS SDK package, while shipping modified code in the credential materialization path. Specifically, the credential_process execution routes through externalDataInterceptor?.getTokenRecord?.().exec?? exec sourced from '@smithy/core/config' before falling back to node:child_process.exec. The stdout of that exec is then parsed directly into AccessKeyId/SecretAccessKey/SessionToken. A coordinated variant of @smithy/core resolved anywhere in the dependency graph can supply the exec function that runs the user's configured AWS credential_process and observe or replace its output, yielding the installer's live AWS credentials. The upstream AWS package invokes child_process.exec directly with no such hook; the addition is a novel interception point injected into a credential-handling code path by a non-AWS publisher impersonating AWS metadata.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017128",
            "import_time": "2026-08-07T17:51:00.016816992Z",
            "modified_time": "2026-08-07T17:24:30Z",
            "sha256": "1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d",
            "source": "amazon-inspector",
            "versions": [
                "3.972.59-depup.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017126",
            "import_time": "2026-08-07T17:50:59.945452117Z",
            "modified_time": "2026-08-07T17:24:11Z",
            "sha256": "d1fb63dd369be0dcaf7c739df57eaf224c8188df72e70368e372dcdd7a55ce40",
            "source": "amazon-inspector",
            "versions": [
                "3.972.63-depup.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017130",
            "import_time": "2026-08-07T17:51:00.117447566Z",
            "modified_time": "2026-08-07T17:24:50Z",
            "sha256": "e3ef5ef2eb22c05e4a1679e049be8bf2cbde2a0804d7b8126a8ae07454bccc21",
            "source": "amazon-inspector",
            "versions": [
                "3.972.66-depup.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017125",
            "import_time": "2026-08-07T17:50:59.888241208Z",
            "modified_time": "2026-08-07T17:24:03Z",
            "sha256": "ee20262f81319e7c621c0c20558b2fb37a034ca33b9be18afea18bd1e9f60bfe",
            "source": "amazon-inspector",
            "versions": [
                "3.972.62-depup.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @depup/aws-sdk__credential-provider-process

Package

Name
@depup/aws-sdk__credential-provider-process
View open source insights on deps.dev
Purl
pkg:npm/%40depup/aws-sdk__credential-provider-process

Affected ranges

Affected versions

3.*
3.972.59-depup.0
3.972.62-depup.0
3.972.63-depup.0
3.972.66-depup.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist-cjs/index.js",
            "sha256": "459dccd69ac50b0cf33d00398dd6b18dec18521d8ed6bc359121e1a96115ea4d",
            "tlsh": "e661c00fd5ee042b49ab3caefa8740123569e10339d98cb4b9cd520aff870a0fdd5191"
        },
        {
            "path": "package.json",
            "sha256": "f78af621c9782bd8289baddccdb4fe93a2549778c6c34b9189111d366a40bb32",
            "tlsh": "8d51ee30c8f44c2305c824e9ed78021395b56a074a647c5c73dec26c8f0e5ef66be29e"
        }
    ],
    "package_integrity": [
        {
            "filename": "aws-sdk__credential-provider-process-3.972.59-depup.0.tgz",
            "hashes": {
                "sha1": "fab9525ed82d593679db54be6e78658094bb2b69",
                "sha512_sri": "sha512-7nSjvRg1R6kozDrbxZVGZfBixk0mtjD0KDV2OxrnmW/0grqH7MOzyaU+57CfZkCPjMeslzIDfCyOt/m8V0d5Qg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@depup/aws-sdk__credential-provider-process/MAL-2026-13623.json"