MAL-2026-13623

Dashboard / Malicious Package / MAL-2026-13623

MAL-2026-13623

Summary: Malicious code in @depup/aws-sdk__credential-provider-process (npm)

Details: Source: amazon-inspector (1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d) @depup/aws-sdk__credential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author, homepage, and repository metadata to present itself as a drop-in dep-bumped variant of the AWS SDK package, while shipping modified code in the credential materialization path. Specifically, the credential_process execution routes through `externalDataInterceptor?.getTokenRecord?.().exec?? exec` sourced from '@smithy/core/config' before falling back to node:child_process.exec. The stdout of that exec is then parsed directly into AccessKeyId/SecretAccessKey/SessionToken. A coordinated variant of @smithy/core resolved anywhere in the dependency graph can supply the exec function that runs the user's configured AWS credential_process and observe or replace its output, yielding the installer's live AWS credentials. The upstream AWS package invokes child_process.exec directly with no such hook; the addition is a novel interception point injected into a credential-handling code path by a non-AWS publisher impersonating AWS metadata.

References: https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.59-depup.0, https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.63-depup.0, https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.66-depup.0, https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.62-depup.0