Loading npm security reports…

aws-data-landing-zone: Suspicious npm security report (Warn) | LPM Firewall

registry / aws-data-landing-zone / 0.6.1

aws-data-landing-zone@0.6.1

AWS CDK Data Landing Zone construct

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 165 file(s), 13.9 MB of source, external domains: 169.254.169.254, 169.254.170.2, a.co, analytics.ahrefs.com, aws.amazon.com, bcm-data-exports.eu-isoe-west-1.cloud.adc-e.uk, bcm-data-exports.us-iso-east-1.c2s.ic.gov, bcm-data-exports.us-isob-east-1.sc2s.sgov.gov, bcm-data-exports.us-isof-south-1.csp.hci.ic.gov, cdn.usefathom.com, ce.cn-northwest-1.api.amazonwebservices.com.cn, ce.eu-isoe-west-1.cloud.adc-e.uk, ce.eusc-de-east-1.api.amazonwebservices.eu, ce.us-east-1.api.aws, ce.us-iso-east-1.c2s.ic.gov, ce.us-isob-east-1.sc2s.sgov.gov, ce.us-isof-south-1.csp.hci.ic.gov, datalandingzone.com, docs.aws.amazon.com, fonts.googleapis.com, fonts.gstatic.com, github.com, iam-fips.global.api.aws, iam-fips.us-iso-east-1.c2s.ic.gov, iam-fips.us-isob-east-1.sc2s.sgov.gov, iam.amazonaws.com, iam.cn-north-1.amazonaws.com.cn, iam.eu-isoe-west-1.cloud.adc-e.uk, iam.eusc-de-east-1.amazonaws.eu, iam.global.api.amazonwebservices.com.cn, iam.global.api.aws, iam.us-gov.amazonaws.com, iam.us-gov.api.aws, iam.us-iso-east-1.c2s.ic.gov, iam.us-isob-east-1.sc2s.sgov.gov, iam.us-isof-south-1.csp.hci.ic.gov, organizations-fips.us-east-1.amazonaws.com, organizations.amazonaws.com, organizations.cn-northwest-1.amazonaws.com.cn, organizations.us-east-1.amazonaws.com, organizations.us-gov-west-1.amazonaws.com, organizations.us-iso-east-1.c2s.ic.gov, organizations.us-isob-east-1.sc2s.sgov.gov, organizations.us-isof-south-1.csp.hci.ic.gov, portal.sso, portal.sso-fips, react-native.canny.io, sts.amazonaws.com, token.actions.githubusercontent.com, www.sitemaps.org

Source & flagged code

6 flagged · loading source

docs/.env.developmentView file

•patternName = blocked_file severity = critical matchedText = docs/.env.development redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

docs/.env.developmentView on unpkg

lib/scripts/lib/helpers.jsView file

4exports.assumeRole = assumeRole; L5: const child_process_1 = require("child_process"); L6: const client_sts_1 = require("@aws-sdk/client-sts");

High

Child Process

Package source references child process execution.

lib/scripts/lib/helpers.jsView on unpkg · L4

lib/constructs/dlz-lake-formation/dlz-lake-formation.jsView file

49} L50: // WARN: Currently broken due to AWS API!!! https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/2197 L51: const defaultPermissions = hybridMode ... L121: DlzLakeFormation[_a] = { fqn: "aws-data-landing-zone.DlzLakeFormation", version: "0.6.1" }; L122: //# sourceMappingURL=data:application/json;base64,[redacted]...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/constructs/dlz-lake-formation/dlz-lake-formation.jsView on unpkg · L49

assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.jsView file

43if (version && !state.warningEmitted) { L44: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L45: state.warningEmitted = true; ... L58: L59: More information can be found at: https://a.co/c895JFp`); L60: } ... L638: if (reason?.$responseBodyText) { L639: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L640: } ... L824: } L825: return Buffer.from(input, offset, length); L826: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.jsView on unpkg · L43

43Cross-file remote execution chain: assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.js spawns assets/constructs/dlz-guardduty/lambda/guardduty-delegated-admin/index.js; helper contains network access plus dynamic code execution. L43: if (version && !state.warningEmitted) { L44: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L45: state.warningEmitted = true; ... L58: L59: More information can be found at: https://a.co/c895JFp`); L60: } ... L638: if (reason?.$responseBodyText) { L639: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L640: } ... L824: } L825: return Buffer.from(input, offset, length); L826: };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.jsView on unpkg · L43

npm-link-manual.shView file

•path = npm[redacted] kind = build_helper sizeBytes = 35 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

npm-link-manual.shView on unpkg

Source & flagged code

6 flagged

docs/.env.developmentView file

•patternName = blocked_file severity = critical matchedText = docs/.env.development redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

docs/.env.developmentView on unpkg

lib/scripts/lib/helpers.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.runCommand = runCommand;

4exports.assumeRole = assumeRole;

5const child_process_1 = require("child_process");

6const client_sts_1 = require("@aws-sdk/client-sts");

High

Child Process

Package source references child process execution.

lib/scripts/lib/helpers.jsView on unpkg · L4

7const credential_providers_1 = require("@aws-sdk/credential-providers");

8async function runCommand(command, args, options = {}, outputPrefix = '', echoCommand = true, exitProcessOnError = true) {

9 if (echoCommand)

10 console.log(outputPrefix + '> Running:', command, args);

11 const argsArray = args.split(' ');

12 const child = (0, child_process_1.spawn)(command, argsArray, {

13 stdio: ['inherit', 'pipe', 'pipe'],

14 env: {

15 ...process.env,

16 ...options.env,

17 FORCE_COLOR: 'true',

18 },

19 cwd: options.cwd,

20 shell: true,

21 });

22 let stdoutAll = '';

23 let stderrAll = '';

24 let stdoutLineBuffer = '';

lib/constructs/dlz-lake-formation/dlz-lake-formation.jsView file

Lines 29-69javascript

29 }

30 }

31 for (const permission of this.props.permissions) {

32 const { principals, tags, databaseActions,

assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.jsView file

43if (version && !state.warningEmitted) { L44: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L45: state.warningEmitted = true; ... L58: L59: More information can be found at: https://a.co/c895JFp`); L60: } ... L638: if (reason?.$responseBodyText) { L639: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L640: } ... L824: } L825: return Buffer.from(input, offset, length); L826: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.jsView on unpkg · L43

43Cross-file remote execution chain: assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.js spawns assets/constructs/dlz-guardduty/lambda/guardduty-delegated-admin/index.js; helper contains network access plus dynamic code execution. L43: if (version && !state.warningEmitted) { L44: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L45: state.warningEmitted = true; ... L58: L59: More information can be found at: https://a.co/c895JFp`); L60: } ... L638: if (reason?.$responseBodyText) { L639: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L640: } ... L824: } L825: return Buffer.from(input, offset, length); L826: };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

assets/constructs/dlz-guardduty/lambda/guardduty-member-features/index.jsView on unpkg · L43

npm-link-manual.shView file

•path = npm[redacted] kind = build_helper sizeBytes = 35 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

npm-link-manual.shView on unpkg