The ledgerflow-deploy-utils package (version 1.0.1) includes a postinstall script that contacts the AWS instance metadata service at 169.254.169.254 to obtain IAM role credentials. It then transmits this sensitive information and a reachability probe to a hardcoded IP address (54.226.194.239) via plain HTTP. The package's exported API consists solely of no-operation console logging stubs, confirming that its main function is to perform install-time reconnaissance on AWS environments. This technique is consistent with dependency confusion or internal name squatting attacks designed to compromise cloud credentials by exploiting package installation in corporate CI/build systems.

Exposure of AWS IAM role information to an attacker-controlled server can lead to credential compromise and unauthorized access to the victim's AWS environment. This may enable attackers to perform follow-on actions such as privilege escalation, data exfiltration, or further lateral movement within the cloud infrastructure. The malicious activity occurs during package installation, potentially affecting automated build and deployment pipelines that use this package.

No official patch or remediation is currently documented for this package. Users should avoid installing ledgerflow-deploy-utils version 1.0.1. Review and audit dependencies for suspicious or unexpected packages, especially those with internal or generic names. Implement strict controls on package sources and consider using allowlists for dependencies in build environments. Monitor for any updates or advisories from the package maintainers or npm registry regarding this issue.