AWS Security Digest·Week 31 of 2026·Jul 27 - Aug 2, 2026·8 items
AWS Names North Korea in the npm Supply Chain Attacks
AWS attributes the debug, chalk, and axios npm compromises to North Korea's SAPPHIRE SLEET group, with Wiz data showing roughly 1 in 10 cloud environments hit within a two-hour window. Shield Advanced begins migrating to the WAF Anti-DDoS managed rule group as its default Layer 7 protection. Four new AWS security bulletins land, including an unauthenticated DoS in aws-smithy-json.
In this issue1critical3high3medium1info
Highlights
4 items
$ tail -f /var/log/aws-security.log
critical/Threat Intel/
AWS Attributes npm Supply Chain Attacks to North Korea's SAPPHIRE SLEET
AWS identified SAPPHIRE SLEET (also tracked as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces) as behind a string of npm supply chain compromises, with medium confidence: typo-crypto (March 2025), debug and chalk (September 2025), and axios (March 2026) via maintainer social engineering.
Axios has more than 100 million weekly downloads, and Wiz Research found roughly 1 in 10 cloud environments were affected by the debug/chalk event within a two-hour window. AWS and partners jointly invested $12.5 million through the Akrites initiative to defend the open-source ecosystem from AI-driven attacks.
high/Service Update/
Shield Advanced Migrates to the WAF Anti-DDoS Managed Rule Group
AWS is replacing Shield Advanced's legacy automatic Layer 7 mitigation with the AWS WAF Anti-DDoS managed rule group as the default. Eligible web ACLs get the rule group in count mode from July 27 - August 7, with a fee-free evaluation period through September 30, automatic upgrades starting October 1, and a guided migration window for ineligible ACLs through December 31.
The legacy automatic mitigation feature stops being available January 1, 2027. The new rule group also needs only 50 WCUs versus 150 previously, freeing capacity for other rules.
ShieldWAF
info/Feature Launch/
Amazon Inspector SBOM Generator Adds a Lua Plugin System
Inspector SBOM Generator v1.13 introduces sandboxed Lua plugins for custom package collectors, blocking direct filesystem access, subprocess execution, and VM introspection.
AWS migrated more than 20 existing ecosystems to the plugin model, including Apache Tomcat, NGINX, MySQL, Redis, WordPress, and OpenSSH, and added over ten new ones such as Apache Cassandra, Apache Struts, Conda, and Swift packages, plus AI-agent collectors for Amazon Q Developer, Kiro CLI, Claude Code, GitHub Copilot, and Ollama.
Inspector
medium/Feature Launch/
Amazon Linux 2023 Adds Opt-In Cooldown Periods for npm and pip Installs
A new Security Blog post shows how to configure a package "cooldown" on Amazon Linux 2023 (release 2023.11.20260608+, Node.js 24 / Python 3.14): sudo npm-24 config set min-release-age 1 --location=global delays npm installs by 24 hours, and sudo python3.14 -m pip config set --global global.uploaded-prior-to P1D does the same for pip.
This is opt-in, not a default. AWS cites a run of fast-moving 2025-2026 supply chain incidents as motivation - Nx s1ngularity, axios, Bitwarden CLI, TanStack, and node-ipc - some of which spread within minutes to a few hours of publication, faster than most teams can react manually.
Amazon Linux
CVEs & Vulnerabilities
4 items
$ cat /var/reports/CVE_REPORT.txt
high/CVE/
CVE-2026-18140: Unauthenticated DoS in aws-smithy-json
A single small HTTP request with deeply nested JSON can crash any smithy-rs generated server via stack exhaustion in aws-smithy-json's unknown-key skip path. No workaround exists; affects aws-smithy-json <= 0.62.6, fixed in 0.62.7.
Affected
aws-smithy-json <= 0.62.6
Fixed In
aws-smithy-json 0.62.7
SDK for Rust
high/CVE/
CVE-2026-18394: Strands Agents http_request Tool Can Leak Credentials via Prompt Injection
The http_request tool in strands-agents-tools exposes a proxies parameter that an agent processing untrusted content can be tricked into setting to an attacker-controlled endpoint, routing requests - and any Authorization header credentials - through the attacker's proxy despite hostname allowlisting. Fixed in 0.8.2; AWS also recommends rotating any credentials set via HTTP_REQUEST_TOKEN_CONFIG.
Affected
strands-agents-tools < 0.8.2
Fixed In
strands-agents-tools 0.8.2
Strands Agents
medium/CVE/
CVE-2026-18245: Code Injection in Amplify's codegen-ui-react
An incomplete fix for the earlier CVE-2025-4318 left @aws-amplify/codegen-ui-react able to run arbitrary JavaScript during component rendering and build. Fixed in 2.20.6 - update the package and any derivative implementations.
The open-source AWS Ops Wheel v2 tool validated its participant URL field only for length, not for safe URL syntax, letting an admin-level user store a script that executes in other users' sessions. Impact is limited to individual deployments. Fixed at PR #168 and later.
Affected
AWS Ops Wheel v2 (pre-PR #168)
Fixed In
AWS Ops Wheel v2 PR #168 and later
Ops Wheel
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
The SAPPHIRE SLEET attribution matters more than any single patch this week: a nation-state actor is now running social-engineering campaigns against npm maintainers at the scale of 100-million-download packages. Turn on the Amazon Linux 2023 cooldown settings today, and start testing Shield Advanced's new Anti-DDoS rule group in count mode before the fee-free window closes September 30.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
