MAL-2026-4255

Dashboard / Malicious Package / MAL-2026-4255

MAL-2026-4255

Summary: Malicious code in cdk-sagemaker-notebook-workflow (npm)

Details: Source: amazon-inspector (6cc9c1db01ca14b294be21438478ec14dc6549a4b7b9ec5cf73dd7aa227f7ad8) The package declares a `preinstall` hook (`node index.js`) in package.json that fires automatically on `npm install`. The script collects `os.hostname()`, `os.userInfo().username`, `os.platform()`, current working directory, home directory, the contents of `/etc/passwd` (`fs.readFileSync('/etc/passwd', 'utf8')`), and the first 30 entries of `process.env` (`Object.entries(process.env).slice(0, 30)`), then POSTs the JSON payload to `https://3nrgzlqwix6erldow0s0kttsojuai36s.oastify.com/greengrass/<execId>` — a Burp Collaborator-style OAST host. Bulk env-var enumeration on CI runners typically captures `AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, `NPM_TOKEN`, and similar credentials. The package name impersonates the AWS CDK construct namespace (`cdk-sagemaker-notebook-workflow`) and the README contains the string `Takeover By l0bo`, confirming attacker intent. This is an unambiguous install-time credential and host-data exfiltrator with a typosquat lure on the AWS CDK ecosystem. Source: ossf-package-analysis (2f835f9a0447616b7070857544dcd2d34d3d287d213eb359769be5cc80daf3e8) The OpenSSF Package Analysis project identified 'cdk-sagemaker-notebook-workflow' @ 2.0.5 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/cdk-sagemaker-notebook-workflow/v/1.0.1, https://www.npmjs.com/package/cdk-sagemaker-notebook-workflow/v/2.0.5, https://www.npmjs.com/package/cdk-sagemaker-notebook-workflow/v/1.0.2, https://www.npmjs.com/package/cdk-sagemaker-notebook-workflow/v/2.0.4, https://www.npmjs.com/package/cdk-sagemaker-notebook-workflow/v/1.0.0, https://www.npmjs.com/package/cdk-sagemaker-notebook-workflow/v/1.0.3