npm package report

Is aws-sdk safe?

2 known vulnerabilities, worst severity HIGH.

// reach

17 direct dependencies

3 carry known advisories, worst CRITICAL

181 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss
7.3
high

CVSS v3.1 base score out of 10

epss
2.2%
medium

chance of exploitation in 30 days, 82nd percentile of all CVEs

xyz score
4.6
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-rrc9-gqf8-8rwg, the advisory selected below

// 2 advisories

GHSA-rrc9-gqf8-8rwg

HIGHGitHub ratingCVE-2020-28472

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Checked 2026-11-07 at 17:26 UTC. The most recent advisory here was published 2026-01-08. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.