Malicious code in aws-blog (npm)

The 'aws-blog' npm package declares a dependency with the same name as itself, pointing to 'https://repo.securityctrl.com/aws-blog' instead of a versioned registry entry. During installation, npm fetches and executes code from this external URL without version pinning or integrity verification, enabling arbitrary code execution. The package's high version number (45.0.0+) and external hosting suggest a dependency confusion attack aimed at users expecting an internal package named 'aws-blog'. The shipped source is an inert stub, with the malicious payload delivered dynamically at install time. This compromises any system installing the package, potentially granting full control to an attacker.

Systems that have installed or run this package are considered fully compromised. Attackers may have executed arbitrary code with the privileges of the installing user. All secrets and keys stored on the compromised system are at risk and must be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Remove the 'aws-blog' package versions 45.0.0, 45.0.1, and 45.0.2 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on compromised machines from a secure environment. Because the package allows arbitrary code execution from an external source, assume full system compromise and conduct a thorough incident response and forensic analysis. Avoid installing packages that declare dependencies with self-referential names pointing to external URLs without integrity checks. Monitor for any signs of persistent compromise.