aws-sdk-v4 @3.650.0
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 11:52 AM UTC
OSV ID
MAL-2026-13218
Ecosystem
npm
Summary
Package aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require() of index.js, JSON-stringifies process.env together with hostname, username, home directory, platform, and current working directory, base64-encodes the blob, and sends it as a Telegram Bot API sendMessage request to a hardcoded bot token and chat_id 8969499041 at api.telegram.org. A temporary flag file gates repeat executions. Any secrets present in the installer's environment (CI tokens, cloud credentials, API keys) are transmitted to the attacker on first import. The package additionally exposes wallet-shaped functions (createWallet, signTransaction, generateMnemonic) inconsistent with its advertised AWS SDK purpose, reinforcing the deceptive-naming delivery vector.
Source: amazon-inspector (3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.