@aws-amplify/core
Core category of aws-amplify
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): AWS-published package with strong track record; dormancy followed by legitimate build system updates, not takeover indicator. | ai | |
| provenance | missing-githead | AI (provenance): Established AWS Amplify package published by aws-amplify-ops with strong track record; missing gitHead is likely a CI pipeline change, not a malicious signal. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper, commonly used implicitly by TypeScript-compiled packages. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Legitimate webpack config pattern for loading react-native-url-polyfill metadata; not arbitrary module loading. | ai | |
| phantom-deps | phantom-dep:@types/node-fetch | AI (phantom-deps): @types/node-fetch is a type declaration package; not directly imported at runtime by design. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reading process.env keys to detect React environment is standard platform detection logic in a core AWS Amplify library. | ai | |
| phantom-deps | phantom-dep:@types/uuid | AI (phantom-deps): @types/ packages are type-only and commonly included without direct imports; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@aws-sdk/url-parser-node | AI (dependencies): @aws-sdk/url-parser-node is an official AWS SDK v3 package from Amazon; the unvetted flag reflects the alpha stage at time of publish, not a security concern. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from mlabieniec to aws-amplify-ops in June 2019 reflects legitimate AWS organizational transfer; stable for this package. | ai | |
| dependencies | unvetted-dep:url | AI (dependencies): Standard Node.js URL utility; legitimate dependency for AWS library. | ai | |
| dependencies | unvetted-dep:@aws-sdk/credential-provider-cognito-identity | AI (dependencies): First-party AWS SDK package; unvetted status expected for beta SDK v3 packages in active development. | ai | |
| dependencies | unvetted-dep:@aws-crypto/sha256-js | AI (dependencies): AWS crypto library; expected dependency for AWS Amplify core. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped @aws-amplify/core package is not a typosquat; legitimate AWS Amplify namespace. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Official AWS package with clear purpose and repository; mass-production signal is false positive for corporate publishers. | ai | |
| dependencies | unvetted-dep:zen-observable | AI (dependencies): zen-observable is an established RxJS-related package; legitimate dependency for observable patterns. | ai | |
| dependencies | unvetted-dep:@aws-sdk/client-cognito-identity | AI (dependencies): Official AWS SDK v3 package; expected dependency for Cognito integration in AWS Amplify. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/node-http-handler | AI (phantom-deps): AWS SDK packages loaded by convention; framework-scoped dependency pattern. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/util-user-agent-browser | AI (phantom-deps): AWS SDK utility package loaded by convention; framework-scoped dependency pattern. | ai | |
| dependencies | unvetted-dep:@aws-sdk/node-http-handler | AI (dependencies): First-party AWS SDK package; unvetted status expected for beta SDK v3 packages in active development. | ai | |
| dependencies | unvetted-dep:zen-observable-ts | AI (dependencies): zen-observable-ts is a known RxJS observable library; unvetted status is metadata signal, not security concern. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() used for safe browser/Node.js environment detection; input is not user-controlled. Legitimate pattern in cross-platform libraries. | ai | |
| dependencies | unvetted-dep:aws-sdk | AI (dependencies): aws-sdk is a core AWS library; pinned version 2.474.0 is stable for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 106 new source files reflect major version bump with AWS SDK v3 integration; no bundled/injected code indicators. | ai | |
| provenance | no-provenance | AI (provenance): AWS Amplify is an established project; missing provenance is a process improvement, not a security blocker for this trusted publisher. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): zen-observable is an established library; new dependency is legitimate for this AWS-maintained package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Maintainer transition to aws-amplify-ops in 2019 is a documented organizational handoff; stable for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Normal maintainer rotation; no compromise indicators present in this established project. | ai |
Versions (showing 100 of 324)
| Version | Deps | Published |
|---|---|---|
| 5.8.11 | 10 / 5 | |
| 5.8.10 | 10 / 5 | |
| 5.8.9 | 10 / 5 | |
| 5.8.8 | 10 / 5 | |
| 5.8.7 | 10 / 5 | |
| 5.8.6 | 10 / 5 | |
| 5.8.5 | 10 / 5 | |
| 5.8.4 | 10 / 5 | |
| 5.8.3 | 10 / 5 | |
| 5.8.2 | 10 / 5 | |
| 5.8.1 | 10 / 5 | |
| 5.8.0 | 10 / 5 | |
| 5.7.0 | 10 / 5 | |
| 5.6.0 | 10 / 5 | |
| 5.5.2 | 9 / 6 | |
| 5.5.1 | 9 / 6 | |
| 5.5.0 | 9 / 6 | |
| 5.4.0 | 9 / 6 | |
| 5.3.1 | 10 / 5 | |
| 5.3.0 | 10 / 5 | |
| 5.2.0 | 9 / 5 | |
| 5.1.13 | 9 / 5 | |
| 5.1.12 | 9 / 5 | |
| 5.1.11 | 9 / 5 | |
| 5.1.10 | 9 / 5 | |
| 5.1.9 | 9 / 5 | |
| 5.1.8 | 9 / 5 | |
| 5.1.7 | 9 / 5 | |
| 5.1.6 | 9 / 5 | |
| 5.1.5 | 9 / 5 | |
| 5.1.4 | 9 / 5 | |
| 5.1.3 | 9 / 5 | |
| 5.1.2 | 9 / 5 | |
| 5.1.1 | 9 / 5 | |
| 5.1.0 | 9 / 5 | |
| 5.0.16 | 9 / 5 | |
| 5.0.15 | 9 / 5 | |
| 5.0.14 | 9 / 5 | |
| 5.0.13 | 9 / 5 | |
| 5.0.12 | 9 / 5 | |
| 5.0.11 | 9 / 5 | |
| 5.0.10 | 9 / 5 | |
| 5.0.9 | 9 / 5 | |
| 5.0.8 | 9 / 5 | |
| 5.0.7 | 9 / 5 | |
| 5.0.6 | 9 / 5 | |
| 5.0.5 | 9 / 5 | |
| 5.0.4 | 9 / 5 | |
| 5.0.3 | 9 / 5 | |
| 5.0.2 | 9 / 5 | |
| 5.0.1 | 9 / 5 | |
| 5.0.0 | 9 / 5 | |
| 4.7.15 | 8 / 5 | |
| 4.7.14 | 8 / 5 | |
| 4.7.13 | 8 / 5 | |
| 4.7.12 | 8 / 5 | |
| 4.7.11 | 8 / 5 | |
| 4.7.10 | 8 / 5 | |
| 4.7.9 | 8 / 5 | |
| 4.7.8 | 8 / 5 | |
| 4.7.7 | 8 / 5 | |
| 4.7.6 | 8 / 5 | |
| 4.7.5 | 8 / 5 | |
| 4.7.4 | 8 / 5 | |
| 4.7.3 | 8 / 5 | |
| 4.7.2 | 8 / 5 | |
| 4.7.1 | 8 / 5 | |
| 4.7.0 | 8 / 5 | |
| 4.6.1 | 8 / 5 | |
| 4.6.0 | 8 / 5 | |
| 4.5.10 | 8 / 5 | |
| 4.5.9 | 8 / 5 | |
| 4.5.8 | 8 / 5 | |
| 4.5.7 | 8 / 5 | |
| 4.5.6 | 8 / 5 | |
| 4.5.5 | 8 / 5 | |
| 4.5.4 | 8 / 5 | |
| 4.5.3 | 8 / 5 | |
| 4.5.2 | 8 / 5 | |
| 4.5.1 | 8 / 5 | |
| 4.5.0 | 8 / 5 | |
| 4.4.2 | 8 / 5 | |
| 4.4.1 | 8 / 5 | |
| 4.4.0 | 8 / 5 | |
| 4.3.14 | 8 / 5 | |
| 4.3.13 | 8 / 5 | |
| 4.3.12 | 8 / 5 | |
| 4.3.11 | 8 / 5 | |
| 4.3.10 | 8 / 5 | |
| 4.3.9 | 8 / 5 | |
| 4.3.8 | 8 / 5 | |
| 4.3.7 | 8 / 5 | |
| 4.3.6 | 8 / 5 | |
| 4.3.5 | 8 / 5 | |
| 4.3.4 | 8 / 5 | |
| 4.3.3 | 8 / 5 | |
| 4.3.2 | 8 / 5 | |
| 4.3.1 | 8 / 5 | |
| 4.3.0 | 8 / 5 | |
| 4.2.11 | 8 / 5 |
v5.8.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.2.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.