{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/aspects/CdkInsightsAspect.js",
              "sha256": "67f6ebad26b822c05d5ff5ca4f5033a5e403dd1cb34f725042d0b7d1b17ed8a1",
              "tlsh": "19f33ac5b755a411439e005a14fd4002f7baee98412960acf3aed6dfb6ccc4966bbb33"
            },
            {
              "path": "dist/entry.js",
              "sha256": "01ff71d3d17a49da98445a5d6b76d453775afaf89fc99d57d6118fe6bb921461",
              "tlsh": "2a854abf674226321fe710e9dc66010ae5a9ae0c8485953af2fce497735185cd2e3f39"
            },
            {
              "path": "dist/index.js",
              "sha256": "0c9a3d2227e9886b746ae0b25ab377f0ff61aecc62bdfaacbf0f2b8a5d7ecd72",
              "tlsh": "581519f76b0636364fa7107aea5a5102f2b56908d8d8541cf6c8d14e3395c3c62e3fba"
            }
          ],
          "package_integrity": [
            {
              "filename": "cdk-insights-1.41.2.tgz",
              "hashes": {
                "sha1": "0d4788d6776b48c12b3cd6b72d4bd629f19e9ae8",
                "sha512_sri": "sha512-uqeMBpmTDCoLS+P1ImVO/At+ngz+an3zY06EvkPasRJ47haGGb+jb8wlt5LoXPLE6ryZGycNb/87XWssfoxx1A=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "cdk-insights"
      },
      "versions": [
        "1.41.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004226",
        "import_time": "2026-05-26T05:52:11.522743274Z",
        "modified_time": "2026-05-22T16:27:47Z",
        "sha256": "fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89",
        "source": "amazon-inspector",
        "versions": [
          "1.41.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89)\nThe package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `writeFileSync` operations \u2014 the canonical wormable auto-publication pattern (enumerate maintainer\u0027s other packages, rewrite their package.json, republish under the installer\u0027s npm credentials). Additionally, dist/aspects/CdkInsightsAspect.js, dist/entry.js, and dist/index.js contain multiple HTTP POST sinks consistent with hardcoded C2 / data-exfiltration endpoints, and CdkInsightsAspect.js contains `ping`-based network reconnaissance. The combination of wormable self-propagation infrastructure plus exfiltration POST endpoints in install/import-reachable code is unambiguous supply-chain attack shape: any developer or CI system installing this package risks (a) having installer-side data POSTed to attacker-controlled endpoints and (b) having their npm credentials abused to republish malicious versions of their other packages.\n",
  "id": "MAL-2026-4508",
  "modified": "2026-05-22T16:27:47Z",
  "published": "2026-05-22T16:27:47Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/cdk-insights/v/1.41.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in cdk-insights (npm)"
}