registry / Malware / cdk-insights

cdk-insights

AWS CDK security and cost analysis CLI. Free static scans via npm - no account needed. Sign up free to add AI-powered insights.

This report shows the evidence for cdk-insights@1.61.0. 9 of 20 known versions are blocked or flagged. The newest version, 1.62.2, is allowed. See all versions.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-4508 confirms this npm version as malicious.

Advisory

MAL-2026-4508

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in cdk-insights (npm)

Details

The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `writeFileSync` operations — the canonical wormable auto-publication pattern (enumerate maintainer's other packages, rewrite their package.json, republish under the installer's npm credentials). Additionally, dist/aspects/CdkInsightsAspect.js, dist/entry.js, and dist/index.js contain multiple HTTP POST sinks consistent with hardcoded C2 / data-exfiltration endpoints, and CdkInsightsAspect.js contains `ping`-based network reconnaissance. The combination of wormable self-propagation infrastructure plus exfiltration POST endpoints in install/import-reachable code is unambiguous supply-chain attack shape: any developer or CI system installing this package risks (a) having installer-side data POSTed to attacker-controlled endpoints and (b) having their npm credentials abused to republish malicious versions of their other packages.

References

OpenSSF/OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to cdk-insights@1.61.0.

The same advisory and Firewall decision cover 6 recorded versions

1.41.2, 1.42.3, 1.59.3, 1.60.0, 1.60.1, 1.61.0

The versions list below shows the verdict for each recorded version.

Avoid installing cdk-insights@1.61.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 19:19:49.900Z (UTC).

Source advisory published: 2026-05-22 16:27:47.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

20 known versions

1.62.2latestClean—AllowPublishedOct 8, 2026, 9:30 PM 1.61.7Clean—AllowPublishedSep 30, 2026, 2:23 PM 1.61.6Clean—AllowPublishedAug 11, 2026, 11:52 PM 1.61.5Clean—AllowPublishedAug 11, 2026, 10:10 PM

OpenSSF/OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages