amplitude-session-replay

Details

**Severity:** Critical

**Affected versions:** `= 45.0.0`

## Source: amazon-inspector (fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713)
package.json declares a dependency whose key is the package's own name (`amplitude-session-replay`) and whose value is a plain HTTPS URL, `https://repo.securityctrl.com/amplitude-session-replay`, instead of a registry version range. On `npm install`, npm fetches the tarball bytes returned by that URL and installs whatever it contains, including running any lifecycle scripts inside — with no version pin, no integrity hash, and no registry vetting. The shipped source in the published tarball is an inert stub, so the manifest itself is the delivery mechanism: whoever controls repo.securityctrl.com controls code executed on the installer's machine at install time. The self-referential dependency name (dependency-confusion shape) also encourages resolvers to prefer this entry over any legitimately-named `amplitude-session-replay` package. The host is unrelated to Amplitude's own domains.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/amplitude-session-replay/MAL-2026-15497.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/amplitude-session-replay/MAL-2026-15497.json
- https://www.npmjs.com/package/amplitude-session-replay/v/45.0.0
- https://github.com/advisories/GHSA-98c6-fgxp-vp9g

Compromised versions (1)

• = 45.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.