MAL-2026-4508

Dashboard / Malicious Package / MAL-2026-4508

MAL-2026-4508

Summary: Malicious code in cdk-insights (npm)

Details: Source: amazon-inspector (fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89) The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `writeFileSync` operations — the canonical wormable auto-publication pattern (enumerate maintainer's other packages, rewrite their package.json, republish under the installer's npm credentials). Additionally, dist/aspects/CdkInsightsAspect.js, dist/entry.js, and dist/index.js contain multiple HTTP POST sinks consistent with hardcoded C2 / data-exfiltration endpoints, and CdkInsightsAspect.js contains `ping`-based network reconnaissance. The combination of wormable self-propagation infrastructure plus exfiltration POST endpoints in install/import-reachable code is unambiguous supply-chain attack shape: any developer or CI system installing this package risks (a) having installer-side data POSTed to attacker-controlled endpoints and (b) having their npm credentials abused to republish malicious versions of their other packages.

References: https://www.npmjs.com/package/cdk-insights/v/1.41.2, https://www.npmjs.com/package/cdk-insights/v/1.42.3, https://www.npmjs.com/package/cdk-insights/v/1.59.3, https://www.npmjs.com/package/cdk-insights/v/1.60.0, https://www.npmjs.com/package/cdk-insights/v/1.58.1, https://www.npmjs.com/package/cdk-insights/v/1.61.0, https://www.npmjs.com/package/cdk-insights/v/1.59.2, https://www.npmjs.com/package/cdk-insights/v/1.60.1, https://www.npmjs.com/package/cdk-insights/v/1.59.1