Malicious code in @depup/aws-sdk__credential-provider-process (npm)
The @depup/aws-sdk__credential-provider-process npm package is a malicious republished fork of the official AWS SDK credential provider. It impersonates the official package by preserving AWS metadata but injects modified code that intercepts the execution of AWS credential processes. This interception allows the attacker to capture or replace AWS credentials by hooking into the credential materialization path, potentially exposing live AWS credentials to the attacker. The affected versions are specific republished versions with the 'depup' suffix. No official patch or remediation guidance is currently available.
AI Analysis
Technical Summary
@depup/aws-sdk__credential-provider-process is a malicious fork of the official @aws-sdk/credential-provider-process package. It maintains AWS author and repository metadata to appear legitimate while modifying the credential retrieval process. The package introduces an interception point via externalDataInterceptor?.getTokenRecord?.().exec that can override the exec function used to run the AWS credential_process command. This allows an attacker to observe or manipulate the output that contains AWS AccessKeyId, SecretAccessKey, and SessionToken. The official AWS package does not have this interception, making this a novel attack vector introduced by the malicious republisher. The affected versions are exactly =3.972.59-depup.0, =3.972.62-depup.0, =3.972.63-depup.0, and =3.972.66-depup.0.
Potential Impact
If installed, this malicious package can capture or alter live AWS credentials during the credential retrieval process, potentially leading to unauthorized access to AWS resources. This compromises the confidentiality and integrity of AWS credentials for users relying on this package. There is no indication of active exploitation in the wild at this time.
Mitigation Recommendations
No official patch or remediation guidance is currently provided. Users should avoid using the @depup/aws-sdk__credential-provider-process package and instead use the official @aws-sdk/credential-provider-process package from trusted sources. Verify package integrity and source before installation to prevent supply chain compromise. Monitor for updates from the official AWS SDK maintainers or security advisories for any further guidance.
Malicious code in @depup/aws-sdk__credential-provider-process (npm)
Description
The @depup/aws-sdk__credential-provider-process npm package is a malicious republished fork of the official AWS SDK credential provider. It impersonates the official package by preserving AWS metadata but injects modified code that intercepts the execution of AWS credential processes. This interception allows the attacker to capture or replace AWS credentials by hooking into the credential materialization path, potentially exposing live AWS credentials to the attacker. The affected versions are specific republished versions with the 'depup' suffix. No official patch or remediation guidance is currently available.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
@depup/aws-sdk__credential-provider-process is a malicious fork of the official @aws-sdk/credential-provider-process package. It maintains AWS author and repository metadata to appear legitimate while modifying the credential retrieval process. The package introduces an interception point via externalDataInterceptor?.getTokenRecord?.().exec that can override the exec function used to run the AWS credential_process command. This allows an attacker to observe or manipulate the output that contains AWS AccessKeyId, SecretAccessKey, and SessionToken. The official AWS package does not have this interception, making this a novel attack vector introduced by the malicious republisher. The affected versions are exactly =3.972.59-depup.0, =3.972.62-depup.0, =3.972.63-depup.0, and =3.972.66-depup.0.
Potential Impact
If installed, this malicious package can capture or alter live AWS credentials during the credential retrieval process, potentially leading to unauthorized access to AWS resources. This compromises the confidentiality and integrity of AWS credentials for users relying on this package. There is no indication of active exploitation in the wild at this time.
Mitigation Recommendations
No official patch or remediation guidance is currently provided. Users should avoid using the @depup/aws-sdk__credential-provider-process package and instead use the official @aws-sdk/credential-provider-process package from trusted sources. Verify package integrity and source before installation to prevent supply chain compromise. Monitor for updates from the official AWS SDK maintainers or security advisories for any further guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13623
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a774329bf8831d539b45d24
Added to database: 08/08/2026, 14:54:33 UTC
Last enriched: 08/08/2026, 15:36:57 UTC
Last updated: 08/08/2026, 20:00:42 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.