Malicious Package Affecting awscloud-clients-core package, versions [0,]
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-AWSCLOUDCLIENTSCORE-12201348
- published26 Aug 2025
- disclosed26 Aug 2025
- creditReversingLabs
Introduced: 26 Aug 2025
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the awscloud-clients-core package.
Overview
awscloud-clients-core is a malicious package. This package contains malicious code disguised as a legitimate cloud client utility, and its content has been removed from the official package manager. Its primary purpose is to steal cloud-related secrets, such as API keys and access tokens. The package accomplishes this by including a malicious dependency that facilitates the exfiltration of credentials.