{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist-cjs/index.js",
              "sha256": "459dccd69ac50b0cf33d00398dd6b18dec18521d8ed6bc359121e1a96115ea4d",
              "tlsh": "e661c00fd5ee042b49ab3caefa8740123569e10339d98cb4b9cd520aff870a0fdd5191"
            },
            {
              "path": "package.json",
              "sha256": "f78af621c9782bd8289baddccdb4fe93a2549778c6c34b9189111d366a40bb32",
              "tlsh": "8d51ee30c8f44c2305c824e9ed78021395b56a074a647c5c73dec26c8f0e5ef66be29e"
            }
          ],
          "package_integrity": [
            {
              "filename": "aws-sdk__credential-provider-process-3.972.59-depup.0.tgz",
              "hashes": {
                "sha1": "fab9525ed82d593679db54be6e78658094bb2b69",
                "sha512_sri": "sha512-7nSjvRg1R6kozDrbxZVGZfBixk0mtjD0KDV2OxrnmW/0grqH7MOzyaU+57CfZkCPjMeslzIDfCyOt/m8V0d5Qg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@depup/aws-sdk__credential-provider-process"
      },
      "versions": [
        "3.972.59-depup.0",
        "3.972.63-depup.0",
        "3.972.66-depup.0",
        "3.972.62-depup.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017128",
        "import_time": "2026-08-07T17:51:00.016816992Z",
        "modified_time": "2026-08-07T17:24:30Z",
        "sha256": "1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d",
        "source": "amazon-inspector",
        "versions": [
          "3.972.59-depup.0"
        ]
      },
      {
        "id": "IN-MAL-2026-017126",
        "import_time": "2026-08-07T17:50:59.945452117Z",
        "modified_time": "2026-08-07T17:24:11Z",
        "sha256": "d1fb63dd369be0dcaf7c739df57eaf224c8188df72e70368e372dcdd7a55ce40",
        "source": "amazon-inspector",
        "versions": [
          "3.972.63-depup.0"
        ]
      },
      {
        "id": "IN-MAL-2026-017130",
        "import_time": "2026-08-07T17:51:00.117447566Z",
        "modified_time": "2026-08-07T17:24:50Z",
        "sha256": "e3ef5ef2eb22c05e4a1679e049be8bf2cbde2a0804d7b8126a8ae07454bccc21",
        "source": "amazon-inspector",
        "versions": [
          "3.972.66-depup.0"
        ]
      },
      {
        "id": "IN-MAL-2026-017125",
        "import_time": "2026-08-07T17:50:59.888241208Z",
        "modified_time": "2026-08-07T17:24:03Z",
        "sha256": "ee20262f81319e7c621c0c20558b2fb37a034ca33b9be18afea18bd1e9f60bfe",
        "source": "amazon-inspector",
        "versions": [
          "3.972.62-depup.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d)\n@depup/aws-sdk__credential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author, homepage, and repository metadata to present itself as a drop-in dep-bumped variant of the AWS SDK package, while shipping modified code in the credential materialization path. Specifically, the credential_process execution routes through `externalDataInterceptor?.getTokenRecord?.().exec?? exec` sourced from \u0027@smithy/core/config\u0027 before falling back to node:child_process.exec. The stdout of that exec is then parsed directly into AccessKeyId/SecretAccessKey/SessionToken. A coordinated variant of @smithy/core resolved anywhere in the dependency graph can supply the exec function that runs the user\u0027s configured AWS credential_process and observe or replace its output, yielding the installer\u0027s live AWS credentials. The upstream AWS package invokes child_process.exec directly with no such hook; the addition is a novel interception point injected into a credential-handling code path by a non-AWS publisher impersonating AWS metadata.\n",
  "id": "MAL-2026-13623",
  "modified": "2026-08-07T17:52:50Z",
  "published": "2026-08-07T17:24:03Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.59-depup.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.63-depup.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.66-depup.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@depup/aws-sdk__credential-provider-process/v/3.972.62-depup.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @depup/aws-sdk__credential-provider-process (npm)"
}