AWS Security Digest

Monday,
April 06, 2026

🥖 Palette Cleanser

The big rah rah this week was that Anthropic accidentally shipped Claude Code version 2.1.88 with a 59.8 MB TypeScript source map included in the npm package, before pulling it within hours. But was it really that bad? The compiled JavaScript bundle was always public on npm (that's just how packages work), but the source map embedded the original ~512,000 TypeScript lines exposing internal tool architecture, permission enforcement logic, trust model logic, and session token handling that would otherwise be unreadable in minified form.

Supply chain attacks are getting more targeted and sophisticated and the axios maintainer's account of how he was compromised is worth reading in full. In his own words, the attacker reached out masquerading as a company founder, having cloned both the founder's likeness and the company itself. They invited him to a real Slack workspace branded to the company, with channels sharing LinkedIn posts, fake employee profiles, and fake profiles of other OSS maintainers to build credibility. They then scheduled a Teams meeting. During the call his system displayed a message that something was out of date and he installed what he assumed was a Teams update. That was the RAT. Everything was well coordinated, looked legitimate, and was done professionally. No wonder the guy fell for it.

Have feedback about AWS Security Digest? Tell us here. This issue is also available to share online.

📋 Chef's selections

AWS CodeBuild - Escalating Privileges via AWS CodeConnections by Thomas Preece

There's an undocumented internal endpoint at codebuild-builds.{REGION}.amazonaws.com that responds to a GetBuildInfo call and returns the raw GitHub App installation token (or Bitbucket JWT token) your CodeConnections app uses to pull source. That token has administration write permissions over every repo the app has been granted access to, branch protections included. Thomas walks through the full exploit path so you can check your own environment.
Navigating Amazon Bedrock's Multi-Agent Applications by Jay Chen and Royce Lu

As a legitimate user with chatbot access, you can craft inputs that enumerate collaborator agents, traverse the orchestration layer, and invoke downstream tools with attacker-controlled content. Jay and Royce map out how supervisor agents process and delegate requests without reliably distinguishing adversarial inputs from legitimate ones, so a crafted payload can chain through an entire multi-agent workflow. Every agent you add to the pipeline is another link an attacker can pull.
Enforcing AI Governance Across AWS Organizations by Nigel Sood

Bedrock guardrails are great until you realize they're configured per account with no org-level enforcement. This post walks through five controls for pushing AI governance across an AWS Organization and the detail worth pausing on is that SCPs blocking bedrock:* don't cover model invocations made via the OpenAI-compatible SDK, which uses a completely separate bedrock-mantle IAM namespace that needs its own deny statements. There's also a good section on long-term Bedrock API keys, which silently create IAM users under the hood with permissions broad enough to delete your guardrails.

Bonusii:

🥗 AWS security blogs

🍛 Reddit threads on r/aws

No threads this week.

💸 Sponsor shoutout

Meet Pleri: your AI security engineer. She’s not a chatbot. Pleri proactively finds meaningful security work and fixes issues before they become problems.

Learn more about Pleri and see her in action.

🥖 Palette Cleanser

📋 Chef's selections

🥗 AWS security blogs

🍛 Reddit threads on r/aws

💸 Sponsor shoutout

🤖 Dessert

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

🎮 Amazon Linux vulnerabilities

📺 AWS security bulletins

🚬 Security documentation changes