MAL-2026-3752

    Dashboard / Malicious Package / MAL-2026-3752

    MAL-2026-3752

    Published: 15 May 2026Last Modified: 15 May 2026

    Summary: Malicious code in cdp-core (npm)

    Details: Source: amazon-inspector (dbf55b093e3a93e8d3f536101e62e09cf7e86636cd42813d02f518138cbcb8ed) The package ships cdp_inject.js, which combines child_process, fs, http/https, and base64 encoding to gather system information and exfiltrate it over the network. The file imports http, https, fs, and child_process at the top, reads process.env.USER and other environment data, executes shell utilities (including ping for host reconnaissance), reads files via fs.readFileSync, base64-encodes the collected content (toString('base64') at L205 and L209), and posts it out via https.request/http.get with a hardcoded hostname and POST body. This is the canonical sysinfo+filesystem credential-stealer shape: the package's only on-load effect is to harvest installer-side data and ship it to a network destination. The package name ("cdp-core") and absence of any legitimate library functionality consistent with this code further indicate the file's purpose is exfiltration rather than a documented feature.

    References: https://www.npmjs.com/package/cdp-core/v/1.0.6, https://www.npmjs.com/package/cdp-core/v/1.0.4

    Affected packages

    Package

    Name: cdp-core

    Purl: pkg:npm/cdp-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.6
    1.0.4
    MAL-2026-3752 | CVE-DB