🥖 Palate Cleanser

Hacker summer camp has just wrapped up in Vegas. Hope you had fun for those who attended. There were quite a few AWS-related talks, at DEF CON Cloud Village and elsewhere, but not much of the content is online yet except for a couple of decks. Hopefully it starts rolling in next week.

While everyone was in Vegas, someone pushed a malicious commit to the keyv repository and by the end of the day a self-propagating worm had hundreds of npm packages, the cacheable ecosystem included. It sux for us because the malware scrapes STS account metadata, Secrets Manager values across seventeen regions, SSM Parameter Store, and, on Linux runners with sudo, GitHub Actions secrets out of process memory. If a build host ran an install that day, rotate everything that host's role could reach, not just the npm token.

Luckily AWS published eight security bulletins to keep us entertained. Seven of them are about agent tooling. Bedrock AgentCore's harness failed to validate input. Kiro's IDE and CLI resolved executables out of an untrusted project directory on Windows, which is nowhere near Kiro's first code execution bug this year. Three separate MCP servers shipped by AWS itself broke: AWS Transform on path handling, DocumentDB on authorization in its aggregation pipeline tool, and Amazon MQ, which hands over broker credentials and OAuth tokens if you prompt inject it. Strands Agents Tools managed two, an insecure direct object reference in the memory tools and a prompt injection that walks straight through the shell tool's consent gate. The eighth is SSH host key verification disabled in the AWS CLI EMR helpers, which is almost nostalgic.

This issue is also available to share online. Got feedback? Tell us here.