@aws-amplify/api-rest
Api-rest category of aws-amplify
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() is used as the default case in a standard Proxy get trap — idiomatic, non-obfuscated TypeScript code. Not a real obfuscation signal for this package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a well-known implicit TypeScript runtime dependency; phantom-dep firing on it is a stable false positive for TypeScript packages. | ai | |
| provenance | missing-githead | AI (provenance): gitHead absence is a publish environment change, not a security issue; stable for AWS Amplify's established release process. | ai | |
| dependencies | unvetted-dep:axios | AI (dependencies): axios 0.19.0 is a pinned, widely-used HTTP library; stable dependency for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Routine maintainer list update in established monorepo; aws-amplify-ops is institutional AWS account with strong approval track record. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Signals reflect monorepo templated structure, not malicious intent; stable for aws-amplify packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainer on active AWS Amplify project; publisher has 85 approved packages and 2614-day history. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is a CI/CD best practice; its absence is not a security defect for this established package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from aws-amplify-ops to ericclemmons reflects a documented AWS Amplify team transition; ericclemmons is a known AWS Amplify principal engineer. Stable for this package. | ai | |
| dependencies | unvetted-dep:@aws-amplify/core | AI (dependencies): Internal monorepo dependency within aws-amplify; expected and stable for this package. | ai |
Versions (showing 100 of 162)
| Version | Deps | Published |
|---|---|---|
| 4.6.4 | 1 / 3 | |
| 4.6.3 | 1 / 3 | |
| 4.6.2 | 1 / 3 | |
| 4.6.1 | 1 / 3 | |
| 4.6.0 | 1 / 3 | |
| 4.5.0 | 1 / 3 | |
| 4.4.1 | 1 / 3 | |
| 4.4.0 | 1 / 3 | |
| 4.3.0 | 1 / 3 | |
| 4.2.0 | 1 / 3 | |
| 4.1.8 | 1 / 3 | |
| 4.1.7 | 1 / 3 | |
| 4.1.6 | 1 / 3 | |
| 4.1.5 | 1 / 3 | |
| 4.1.4 | 1 / 4 | |
| 4.1.3 | 1 / 4 | |
| 4.1.2 | 1 / 4 | |
| 4.1.1 | 1 / 4 | |
| 4.1.0 | 1 / 4 | |
| 4.0.75 | 1 / 4 | |
| 4.0.74 | 1 / 4 | |
| 4.0.73 | 1 / 4 | |
| 4.0.72 | 1 / 4 | |
| 4.0.71 | 1 / 4 | |
| 4.0.70 | 1 / 4 | |
| 4.0.69 | 1 / 4 | |
| 4.0.68 | 1 / 4 | |
| 4.0.67 | 1 / 3 | |
| 4.0.66 | 1 / 3 | |
| 4.0.65 | 1 / 3 | |
| 4.0.64 | 1 / 3 | |
| 4.0.63 | 1 / 3 | |
| 4.0.62 | 1 / 3 | |
| 4.0.61 | 1 / 3 | |
| 4.0.60 | 1 / 3 | |
| 4.0.59 | 1 / 3 | |
| 4.0.58 | 1 / 3 | |
| 4.0.57 | 1 / 3 | |
| 4.0.56 | 1 / 3 | |
| 4.0.55 | 1 / 3 | |
| 4.0.54 | 1 / 3 | |
| 4.0.53 | 1 / 3 | |
| 4.0.52 | 1 / 3 | |
| 4.0.51 | 1 / 3 | |
| 4.0.50 | 1 / 3 | |
| 4.0.49 | 1 / 3 | |
| 4.0.48 | 1 / 3 | |
| 4.0.47 | 1 / 3 | |
| 4.0.46 | 1 / 3 | |
| 4.0.45 | 1 / 3 | |
| 4.0.44 | 1 / 3 | |
| 4.0.43 | 1 / 3 | |
| 4.0.42 | 1 / 3 | |
| 4.0.41 | 1 / 3 | |
| 4.0.40 | 1 / 3 | |
| 4.0.39 | 1 / 3 | |
| 4.0.38 | 1 / 3 | |
| 4.0.37 | 1 / 3 | |
| 4.0.36 | 1 / 3 | |
| 4.0.35 | 1 / 3 | |
| 4.0.34 | 1 / 3 | |
| 4.0.33 | 1 / 3 | |
| 4.0.32 | 1 / 3 | |
| 4.0.31 | 1 / 3 | |
| 4.0.30 | 1 / 3 | |
| 4.0.29 | 1 / 3 | |
| 4.0.28 | 1 / 3 | |
| 4.0.27 | 1 / 3 | |
| 4.0.26 | 1 / 3 | |
| 4.0.25 | 1 / 3 | |
| 4.0.24 | 1 / 3 | |
| 4.0.23 | 1 / 3 | |
| 4.0.22 | 1 / 3 | |
| 4.0.21 | 1 / 3 | |
| 4.0.20 | 1 / 3 | |
| 4.0.19 | 1 / 3 | |
| 4.0.18 | 1 / 3 | |
| 4.0.17 | 1 / 3 | |
| 4.0.16 | 1 / 3 | |
| 4.0.15 | 1 / 3 | |
| 4.0.14 | 1 / 2 | |
| 4.0.13 | 1 / 5 | |
| 4.0.12 | 1 / 5 | |
| 4.0.11 | 1 / 5 | |
| 4.0.10 | 1 / 5 | |
| 4.0.9 | 1 / 5 | |
| 4.0.8 | 1 / 5 | |
| 4.0.7 | 1 / 5 | |
| 4.0.6 | 1 / 5 | |
| 4.0.5 | 1 / 5 | |
| 4.0.4 | 1 / 5 | |
| 4.0.3 | 1 / 5 | |
| 4.0.2 | 1 / 5 | |
| 4.0.1 | 1 / 5 | |
| 4.0.0 | 1 / 3 | |
| 3.5.21 | 4 / 1 | |
| 3.5.20 | 4 / 1 | |
| 3.5.19 | 4 / 1 | |
| 3.5.18 | 4 / 1 | |
| 3.5.17 | 4 / 1 |
v4.0.28
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.5.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.