Malicious Code Detected in aws-toolkit-cloud9 Package
Summary
MAL-2025-15230: Malicious code in aws-toolkit-cloud9 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aws-toolkit-cloud9 package is an npm library designed to enhance the development experience within the AWS Cloud9 IDE. It provides various tools and integrations to streamline workflows for developers working on AWS projects. However, recent findings have revealed that this package contains malicious code, posing a significant risk to users who rely on it for their development tasks.
Vulnerability Detail
The aws-toolkit-cloud9 package has been identified to contain malicious code that could potentially compromise the security of applications utilizing this package. This vulnerability originated from the inclusion of harmful scripts that may lead to unauthorized access, data breaches, or other malicious activities. Users of this package are at risk of having their systems exploited by attackers leveraging the malicious code embedded within the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall aws-toolkit-cloud9If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that provide similar functionality without the associated risks. Always ensure to review the security of any package before integrating it into your project.
Conclusion
The discovery of malicious code in the aws-toolkit-cloud9 package highlights the importance of vigilance when using open-source libraries. Users are advised to remove the package and monitor their applications for vulnerabilities to ensure security.
See every vulnerability recorded for aws-toolkit-cloud9 →
FAQ
The aws-toolkit-cloud9 package is an npm library that enhances the AWS Cloud9 IDE experience by providing tools and integrations for developers.
The malicious code was identified through security audits and reports from security researchers, including Amazon Inspector.
Using this package may expose your system to unauthorized access, data breaches, and other malicious activities due to the embedded harmful code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. Check your application for vulnerabilities at Vulert Scanner.
If you have used the aws-toolkit-cloud9 package, immediately uninstall it and consider using alternative packages. Regularly check for updates and vulnerabilities in your dependencies.
