MAL-2026-4508

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cdk-insights/MAL-2026-4508.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4508
Published
2026-05-22T16:27:47Z
Modified
2026-08-05T19:19:49.900098770Z
Summary
Malicious code in cdk-insights (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89)

The package contains code in dist/entry.js and dist/index.js that invokes npm publish programmatically combined with writeFileSync operations — the canonical wormable auto-publication pattern (enumerate maintainer's other packages, rewrite their package.json, republish under the installer's npm credentials). Additionally, dist/aspects/CdkInsightsAspect.js, dist/entry.js, and dist/index.js contain multiple HTTP POST sinks consistent with hardcoded C2 / data-exfiltration endpoints, and CdkInsightsAspect.js contains ping-based network reconnaissance. The combination of wormable self-propagation infrastructure plus exfiltration POST endpoints in install/import-reachable code is unambiguous supply-chain attack shape: any developer or CI system installing this package risks (a) having installer-side data POSTed to attacker-controlled endpoints and (b) having their npm credentials abused to republish malicious versions of their other packages.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-26T05:52:11.522743274Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-22T16:27:47Z",
            "sha256": "fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89",
            "id": "IN-MAL-2026-004226",
            "versions": [
                "1.41.2"
            ]
        },
        {
            "import_time": "2026-06-12T19:43:34.547542902Z",
            "sha256": "c881a135de8104d4fb3610e23f98105d97692a8c20b0cad8fb4a45c3d2052e46",
            "modified_time": "2026-06-12T19:02:06Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-005797",
            "versions": [
                "1.42.3"
            ]
        },
        {
            "import_time": "2026-08-05T19:04:54.879064369Z",
            "sha256": "3fb8a2596514db602ed5af1cac685860d88c6c3448c25948c09f0f4b97898b6e",
            "modified_time": "2026-08-05T18:24:43Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015855",
            "versions": [
                "1.59.3"
            ]
        },
        {
            "import_time": "2026-08-05T19:04:54.960702391Z",
            "sha256": "5730037847698ac25c003e2d24da69fd5ce0beb152e533893c88bd412b449cb7",
            "modified_time": "2026-08-05T18:24:51Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015856",
            "versions": [
                "1.60.0"
            ]
        },
        {
            "import_time": "2026-08-05T19:04:54.479814336Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T18:23:57Z",
            "sha256": "67e86d39ceb7e95b87534fab89130689e1a42af6e9cff001b0a7531290d0903d",
            "id": "IN-MAL-2026-015850",
            "versions": [
                "1.58.1"
            ]
        },
        {
            "import_time": "2026-08-05T19:04:54.603206674Z",
            "sha256": "c467b32fdf460bd9e202e144cd9b24a3102eda19b31b5bfb6fdd1d6d111a660f",
            "modified_time": "2026-08-05T18:24:16Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015852",
            "versions": [
                "1.61.0"
            ]
        },
        {
            "import_time": "2026-08-05T19:04:54.795884168Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T18:24:35Z",
            "sha256": "c8f0c46cdceec9c6b8fc25872476957e07206a18a14fd6e11716cfb2971809e7",
            "id": "IN-MAL-2026-015854",
            "versions": [
                "1.59.2"
            ]
        },
        {
            "import_time": "2026-08-05T19:04:54.725126008Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T18:24:27Z",
            "sha256": "f9db10400f950d9a0be522d74238a65a57bd1655b09cc5f1ca6cfaac49c2e421",
            "id": "IN-MAL-2026-015853",
            "versions": [
                "1.60.1"
            ]
        },
        {
            "import_time": "2026-08-05T19:04:54.544142084Z",
            "sha256": "27fad94be236f6496d94f6bdbbfe141acec977e9d2ede163be9c95a41c294803",
            "modified_time": "2026-08-05T18:24:08Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015851",
            "versions": [
                "1.59.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cdk-insights

Package

Name
cdk-insights
View open source insights on deps.dev
Purl
pkg:npm/cdk-insights

Affected ranges

Affected versions

1.*
1.41.2
1.42.3
1.58.1
1.59.1
1.59.2
1.59.3
1.60.0
1.60.1
1.61.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cdk-insights/MAL-2026-4508.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "67f6ebad26b822c05d5ff5ca4f5033a5e403dd1cb34f725042d0b7d1b17ed8a1",
            "path": "dist/aspects/CdkInsightsAspect.js",
            "tlsh": "19f33ac5b755a411439e005a14fd4002f7baee98412960acf3aed6dfb6ccc4966bbb33"
        },
        {
            "sha256": "01ff71d3d17a49da98445a5d6b76d453775afaf89fc99d57d6118fe6bb921461",
            "tlsh": "2a854abf674226321fe710e9dc66010ae5a9ae0c8485953af2fce497735185cd2e3f39",
            "path": "dist/entry.js"
        },
        {
            "sha256": "0c9a3d2227e9886b746ae0b25ab377f0ff61aecc62bdfaacbf0f2b8a5d7ecd72",
            "path": "dist/index.js",
            "tlsh": "581519f76b0636364fa7107aea5a5102f2b56908d8d8541cf6c8d14e3395c3c62e3fba"
        }
    ],
    "package_integrity": [
        {
            "filename": "cdk-insights-1.41.2.tgz",
            "hashes": {
                "sha1": "0d4788d6776b48c12b3cd6b72d4bd629f19e9ae8",
                "sha512_sri": "sha512-uqeMBpmTDCoLS+P1ImVO/At+ngz+an3zY06EvkPasRJ47haGGb+jb8wlt5LoXPLE6ryZGycNb/87XWssfoxx1A=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]