GitHub Advisoryadvisory · npm

GHSA-gfp8-mp24-5vxg @hulumi/baseline: CloudTrail selector tampering events were not fully detected

MEDIUM Published 2026-05-21 Modified 2026-05-21 Official page ↗
Ecosystem
npm
Packages
@hulumi/baseline
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-778
Reviewed
2026-05-21

Affected packages

• npm @hulumi/baseline: < 1.3.2 → fixed in 1.3.2

Description

Impact: @hulumi/baseline versions before 1.3.2 could miss some CloudTrail event-selector tampering evidence, reducing coverage for changes to audit logging configuration. Patched in 1.3.2: detection coverage and regression tests were expanded. Remediation: upgrade @hulumi/baseline to 1.3.2 or later and rerun affected previews/checks.

Related

Weakness · CWE (1)

  • CWE-778 Insufficient Logging weakness

References