Malicious code in @depup/aws-sdk__credential-provider-process (npm)

@depup/aws-sdk__credential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package designed to impersonate the legitimate AWS SDK package. It preserves AWS author, homepage, and repository metadata to present itself as a drop-in variant, while shipping malicious modified code in the credential handling path.\n\nThe attack works by intercepting the credential_process execution through an externalDataInterceptor?.getTokenRecord?.().exec hook sourced from '@smithy/core/config' before falling back to node:child_process.exec. This allows a coordinated malicious variant of @smithy/core in the dependency graph to supply an exec function that can observe or replace the output of the user's configured AWS credential_process, yielding the installer's live AWS credentials.\n\nThe upstream official AWS package invokes child_process.exec directly without such hooks. The addition of this interception point represents a novel attack vector injected into a credential-handling code path by a non-AWS publisher impersonating AWS metadata.\n\nThis incident was identified and credited to the OpenSSF malicious-packages project.