aws

The template does not contain apparent malware or an intentional supply-chain attack. It contains significant security and operational weaknesses: a secret-like credential is configured directly in the template, the placing function has overly broad AWS permissions, CORS is unrestricted, and the SQS visibility timeout is shorter than the consumer timeout. Store credentials in a managed secret store, apply least-privilege IAM policies, restrict allowed origins, and set queue visibility timeout above the maximum processing time.

This policy contains no executable malware or obfuscated code, but it is dangerously overprivileged. The combination of unrestricted CloudFormation and compute deployment, iam:PassRole on all roles, read access to all secrets, an overly broad permissions boundary, and trust for an external account root creates a high-impact privilege-escalation and supply-chain risk. Restrict trusted principals, deployment resources, passable roles, secrets, CloudFormation capabilities, and artifact actions.