@aws-amplify/api-rest
Api-rest category of aws-amplify
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() is used as the default case in a standard Proxy get trap — idiomatic, non-obfuscated TypeScript code. Not a real obfuscation signal for this package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a well-known implicit TypeScript runtime dependency; phantom-dep firing on it is a stable false positive for TypeScript packages. | ai | |
| provenance | missing-githead | AI (provenance): gitHead absence is a publish environment change, not a security issue; stable for AWS Amplify's established release process. | ai | |
| dependencies | unvetted-dep:axios | AI (dependencies): axios 0.19.0 is a pinned, widely-used HTTP library; stable dependency for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Routine maintainer list update in established monorepo; aws-amplify-ops is institutional AWS account with strong approval track record. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Signals reflect monorepo templated structure, not malicious intent; stable for aws-amplify packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainer on active AWS Amplify project; publisher has 85 approved packages and 2614-day history. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is a CI/CD best practice; its absence is not a security defect for this established package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from aws-amplify-ops to ericclemmons reflects a documented AWS Amplify team transition; ericclemmons is a known AWS Amplify principal engineer. Stable for this package. | ai | |
| dependencies | unvetted-dep:@aws-amplify/core | AI (dependencies): Internal monorepo dependency within aws-amplify; expected and stable for this package. | ai |
Versions (showing 51 of 130)
| Version | Deps | Published |
|---|---|---|
| 4.6.4 | 1 / 3 | |
| 4.6.3 | 1 / 3 | |
| 4.6.2 | 1 / 3 | |
| 4.6.1 | 1 / 3 | |
| 4.6.0 | 1 / 3 | |
| 4.5.0 | 1 / 3 | |
| 4.4.1 | 1 / 3 | |
| 4.4.0 | 1 / 3 | |
| 4.3.0 | 1 / 3 | |
| 4.2.0 | 1 / 3 | |
| 4.1.8 | 1 / 3 | |
| 4.1.7 | 1 / 3 | |
| 4.1.6 | 1 / 3 | |
| 4.1.5 | 1 / 3 | |
| 4.1.4 | 1 / 4 | |
| 4.1.3 | 1 / 4 | |
| 4.1.2 | 1 / 4 | |
| 4.1.1 | 1 / 4 | |
| 4.1.0 | 1 / 4 | |
| 4.0.75 | 1 / 4 | |
| 4.0.74 | 1 / 4 | |
| 4.0.73 | 1 / 4 | |
| 4.0.72 | 1 / 4 | |
| 4.0.71 | 1 / 4 | |
| 4.0.70 | 1 / 4 | |
| 4.0.69 | 1 / 4 | |
| 4.0.68 | 1 / 4 | |
| 4.0.67 | 1 / 3 | |
| 4.0.66 | 1 / 3 | |
| 4.0.65 | 1 / 3 | |
| 4.0.64 | 1 / 3 | |
| 4.0.63 | 1 / 3 | |
| 4.0.62 | 1 / 3 | |
| 4.0.61 | 1 / 3 | |
| 4.0.60 | 1 / 3 | |
| 4.0.59 | 1 / 3 | |
| 4.0.58 | 1 / 3 | |
| 4.0.57 | 1 / 3 | |
| 4.0.56 | 1 / 3 | |
| 4.0.55 | 1 / 3 | |
| 4.0.54 | 1 / 3 | |
| 4.0.53 | 1 / 3 | |
| 4.0.52 | 1 / 3 | |
| 4.0.51 | 1 / 3 | |
| 4.0.50 | 1 / 3 | |
| 4.0.49 | 1 / 3 | |
| 4.0.48 | 1 / 3 | |
| 4.0.47 | 1 / 3 | |
| 4.0.46 | 1 / 3 | |
| 4.0.45 | 1 / 3 | |
| 4.0.44 | 1 / 3 |
v4.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.75
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.74
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.73
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.72
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.71
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.70
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.69
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.68
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.67
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.66
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.65
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.64
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.63
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.62
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.61
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.60
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.59
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.58
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.57
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.56
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.55
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.54
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.53
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.52
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.51
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.50
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.49
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.48
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.46
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.45
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.44
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.