Supply chain · npm · High

Critical Malware in npm Package 'lambda-cloudwatch-cdk' Poses Full Compromise Risk

Threat Engine Auto-Feed · data current as of 2026-07-20

The npm package 'lambda-cloudwatch-cdk' has been identified as malicious, leading to full system compromise upon installation. Organizations using this package are at high risk of credential and secret theft, requiring immediate action to detect, contain, and remediate.

  • Package: npm / lambda-cloudwatch-cdk
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~148/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'lambda-cloudwatch-cdk' contains malware. Installation of this package results in a complete compromise of the host system, allowing for potential credential and secret theft. Due to the nature of the compromise, simply removing the package may not fully eliminate all malicious components.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is weaponized. When the compromised package is installed into a development or production environment, it executes unauthorized code, granting an attacker full control over the system. This access can then be leveraged to exfiltrate sensitive data such as credentials and secrets.

Who's exposed

Profiles most at risk

  • Development teams using npm for their projects, particularly those integrating AWS CDK or serverless functions.
  • CI/CD pipelines that automatically pull and install npm dependencies.
  • Organizations with internal package mirrors that may have cached the malicious version.

Conditions that increase exposure

  • Projects with unpinned dependencies that automatically update to the latest package versions.
  • Environments lacking robust software supply chain security controls.
  • Systems where 'lambda-cloudwatch-cdk' was installed directly or as a transitive dependency.

Blast-radius scenarios

  • An attacker gains full control over the compromised system, leading to unauthorized access to sensitive data and infrastructure.
  • Credentials and secrets stored on the affected machine are stolen, enabling lateral movement within the network or access to cloud resources.
  • The compromised system could be used as a pivot point for further attacks or to host additional malicious software.

What to do (defensive)

Detect

  • Identify all systems where 'lambda-cloudwatch-cdk' may have been installed, including development workstations, build servers, and deployment environments.
  • Review package lock files (e.g., package-lock.json) and dependency trees for the presence of 'lambda-cloudwatch-cdk'.
  • Monitor network traffic for unusual outbound connections from systems that installed the package.

Contain

  • Immediately isolate any system identified as having installed 'lambda-cloudwatch-cdk' from the network.
  • Suspend any CI/CD pipelines or automated processes that may install or update npm packages until a thorough review is complete.
  • Block 'lambda-cloudwatch-cdk' from being downloaded or installed via package managers and internal mirrors.

Remediate

  • Consider any system that installed 'lambda-cloudwatch-cdk' as fully compromised and initiate incident response procedures.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised systems, using a separate, trusted machine.
  • Rebuild compromised systems from trusted images or backups, rather than attempting to clean them, to ensure complete removal of malicious components.
  • Update dependency management practices to pin versions and use lock files to prevent automatic installation of new, potentially malicious versions.

Frontier verdict — High

This critical npm package malware requires immediate isolation, credential rotation, and system rebuilds due to full compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.