MAL-2026-4508

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cdk-insights/MAL-2026-4508.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4508
Published
2026-05-22T16:27:47Z
Modified
2026-05-26T06:02:17.575322638Z
Summary
Malicious code in cdk-insights (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89)

The package contains code in dist/entry.js and dist/index.js that invokes npm publish programmatically combined with writeFileSync operations — the canonical wormable auto-publication pattern (enumerate maintainer's other packages, rewrite their package.json, republish under the installer's npm credentials). Additionally, dist/aspects/CdkInsightsAspect.js, dist/entry.js, and dist/index.js contain multiple HTTP POST sinks consistent with hardcoded C2 / data-exfiltration endpoints, and CdkInsightsAspect.js contains ping-based network reconnaissance. The combination of wormable self-propagation infrastructure plus exfiltration POST endpoints in install/import-reachable code is unambiguous supply-chain attack shape: any developer or CI system installing this package risks (a) having installer-side data POSTed to attacker-controlled endpoints and (b) having their npm credentials abused to republish malicious versions of their other packages.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-26T05:52:11.522743274Z",
            "sha256": "fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-004226",
            "modified_time": "2026-05-22T16:27:47Z",
            "versions": [
                "1.41.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cdk-insights

Package

Name
cdk-insights
View open source insights on deps.dev
Purl
pkg:npm/cdk-insights

Affected ranges

Affected versions

1.*
1.41.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cdk-insights/MAL-2026-4508.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-uqeMBpmTDCoLS+P1ImVO/At+ngz+an3zY06EvkPasRJ47haGGb+jb8wlt5LoXPLE6ryZGycNb/87XWssfoxx1A==",
                "sha1": "0d4788d6776b48c12b3cd6b72d4bd629f19e9ae8"
            },
            "filename": "cdk-insights-1.41.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "67f6ebad26b822c05d5ff5ca4f5033a5e403dd1cb34f725042d0b7d1b17ed8a1",
            "tlsh": "19f33ac5b755a411439e005a14fd4002f7baee98412960acf3aed6dfb6ccc4966bbb33",
            "path": "dist/aspects/CdkInsightsAspect.js"
        },
        {
            "sha256": "01ff71d3d17a49da98445a5d6b76d453775afaf89fc99d57d6118fe6bb921461",
            "tlsh": "2a854abf674226321fe710e9dc66010ae5a9ae0c8485953af2fce497735185cd2e3f39",
            "path": "dist/entry.js"
        },
        {
            "sha256": "0c9a3d2227e9886b746ae0b25ab377f0ff61aecc62bdfaacbf0f2b8a5d7ecd72",
            "tlsh": "581519f76b0636364fa7107aea5a5102f2b56908d8d8541cf6c8d14e3395c3c62e3fba",
            "path": "dist/index.js"
        }
    ]
}