aws-sdk-java-v2-kms

The fragment is intended to provide AWS KMS-backed encryption and database integration and does not show evidence of malware or deliberate supply-chain sabotage. It contains significant security and correctness issues: arbitrary endpoint configuration, application-managed static credentials, plaintext data keys retained in the cache, zeroing cached keys after use, and especially unsafe deterministic AES-GCM nonce construction. The envelope encryption implementation should not be used without redesigning nonce generation, key-cache handling, and credential configuration. Health endpoint exposure should also be restricted.

The fragment is legitimate AWS KMS demonstration and utility code with no evidence of malicious behavior, data theft, backdoors, or intentional obfuscation. It contains a significant cryptographic implementation flaw in the AES-GCM envelope encryption example because the IV/nonce is not retained for decryption, plus incomplete plaintext-key cleanup on exceptional paths and potential KMS key accumulation in the asynchronous signing example. It should be corrected before production use, but the code does not appear to be malware.