Malicious code in amzn_codewhisperer_streaming_client (crates.io)

The OpenSSF Package Analysis project identified version 99.0.1 of the Rust crate 'amzn-codewhisperer-streaming-client' published on crates.io as containing malicious code. The analysis determined the package exhibits two key indicators of compromise: communication with a domain associated with malicious activity and execution of commands consistent with malicious behavior.\n\nThis appears to be a typosquatting or account compromise incident targeting the legitimate AWS CodeWhisperer streaming client library. The malicious version was published to the public crates.io registry, potentially exposing any developer who installed this specific version to compromise.\n\nThe incident was identified and reported through the OpenSSF's malicious package detection program, which maintains a public catalog of confirmed malicious packages across package ecosystems.