Amazon Inspector Security Research

Amazon Inspector Security Research is a continuous monitoring program that identifies malicious packages published to public package registries. Software supply chain attacks targeting open-source ecosystems are a growing threat, and malicious packages are frequently removed from upstream registries only after they have been downloaded by unsuspecting developers. Amazon Inspector Security Research helps protect your applications by detecting these packages, publishing advisories, and incorporating this intelligence into Amazon Inspector findings so that workloads consuming a known-malicious package are surfaced automatically.

Supported public package registries:

Research methodology

The Amazon Inspector security research team combines automated detection pipelines with expert analyst review to identify malicious packages across supported registries. Each confirmed malicious package is assigned a MAL-ID, documented as a public advisory, and integrated into Amazon Inspector findings so that customers are notified when their workloads consume affected packages. No customer action is required to benefit from this research – detections are applied automatically.

Amazon Inspector is a contributing partner in the Open Source Security Foundation (OpenSSF) Malicious Packages Repository. Advisories produced by Amazon Inspector Security Research are published to this open dataset, giving the broader open-source community access to the same threat intelligence that Amazon Inspector uses to protect AWS customers. The MAL-ID assigned to each advisory is compatible with the OpenSSF advisory format.

Detection summary

The following tables summarize malicious package detections by Amazon Inspector Security Research across all supported registries.

Lifetime totals by registry

Recent activity by registry

Recent malicious package reports

The following table lists the ten most recent malicious package advisories published by Amazon Inspector Security Research, ordered by published date.

Related resources

The following AWS Security Blog posts provide additional context on Amazon Inspector Security Research and recent supply chain threat campaigns: