MAL-2026-13623 Malicious code in @depup/aws-sdk__credential-provider-process (npm)

@depup/aws-sdk__credential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author, homepage, and repository metadata to present itself as a drop-in dep-bumped variant of the AWS SDK package, while shipping modified code in the credential materialization path. Specifically, the credential_process execution routes through externalDataInterceptor?.getTokenRecord?.().exec?? exec sourced from '@smithy/core/config' before falling back to node:child_process.exec. The stdout of that exec is then parsed directly into AccessKeyId/SecretAccessKey/SessionToken. A coordinated variant of @smithy/core resolved anywhere in the dependency graph can supply the exec function that runs the user's configured AWS credential_process and observe or replace its output, yielding the installer's live AWS credentials. The upstream AWS package invokes child_process.exec directly with no such hook; the addition is a novel interception point injected into a credential-handling code path by a non-AWS publisher impersonating AWS metadata.