@aws-amplify/data-schema-types
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | suspicious-version-number | AI (publish-pattern): Version format is legitimate internal AWS pre-release versioning for types packages, not malware. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 33 new files and 392KB tsbuildinfo are expected artifacts for a types package build. | ai | |
| dependencies | unvetted-dep:rxjs | AI (dependencies): rxjs is a foundational library; unvetted status is a false positive for established packages. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (graphql, @aws-amplify/plugin-types) are legitimate and expected for schema types package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Signals (no desc, no repo, no keywords) are false positives for internal AWS types packages. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Internal AWS types packages commonly omit descriptions; not indicative of malice. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of aws-amplify-docs-eng-ops while aws-amplify-ops maintains the package is expected in AWS org restructuring. | ai | |
| provenance | no-provenance | AI (provenance): Provenance is a best-practice recommendation, not a security blocker for AWS-published packages. | ai | |
| phantom-deps | phantom-dep:graphql | AI (phantom-deps): graphql is referenced in config/types; phantom-dep detection is a false positive for types packages. | ai |
Versions (showing 51 of 51)
| Version | Deps | Published |
|---|---|---|
| 1.3.0 | 2 / 3 | |
| 1.2.1 | 2 / 1 | |
| 1.2.0 | 2 / 1 | |
| 1.1.1 | 2 / 1 | |
| 1.1.0 | 2 / 1 | |
| 1.0.1 | 2 / 1 | |
| 1.0.0 | 2 / 1 | |
| 0.10.1 | 3 / 1 | |
| 0.10.0 | 3 / 1 | |
| 0.9.0 | 3 / 1 | |
| 0.8.0 | 2 / 1 | |
| 0.7.17 | 2 / 1 | |
| 0.7.16 | 2 / 1 | |
| 0.7.15 | 2 / 1 | |
| 0.7.14 | 2 / 1 | |
| 0.7.13 | 2 / 1 | |
| 0.7.12 | 2 / 1 | |
| 0.7.11 | 1 / 2 | |
| 0.7.10 | 1 / 2 | |
| 0.7.9 | 1 / 2 | |
| 0.7.8 | 1 / 2 | |
| 0.7.7 | 1 / 2 | |
| 0.7.6 | 1 / 1 | |
| 0.7.5 | 1 / 1 | |
| 0.7.4 | 1 / 1 | |
| 0.7.3 | 1 / 1 | |
| 0.7.2 | 1 / 1 | |
| 0.7.1 | 1 / 1 | |
| 0.7.0 | 1 / 1 | |
| 0.6.12 | 1 / 1 | |
| 0.6.11 | 1 / 1 | |
| 0.6.10 | 1 / 1 | |
| 0.6.9 | 1 / 1 | |
| 0.6.8 | 1 / 1 | |
| 0.6.7 | 1 / 1 | |
| 0.6.6 | 1 / 1 | |
| 0.6.5 | 1 / 1 | |
| 0.6.4 | 1 / 1 | |
| 0.6.3 | 1 / 1 | |
| 0.6.2 | 1 / 1 | |
| 0.6.1 | 1 / 1 | |
| 0.6.0 | 1 / 1 | |
| 0.5.0 | 1 / 1 | |
| 0.4.2 | 1 / 1 | |
| 0.4.1 | 1 / 1 | |
| 0.4.0 | 1 / 1 | |
| 0.7.17--.e764a34.0 | 2 / 1 | |
| 0.0.0-types-versions-20240419160146 | 3 / 1 | |
| 0.0.0-types-versions-20240419151108 | 3 / 1 | |
| 0.0.0-tagged-release-test-20240413153935 | 2 / 1 | |
| 0.0.0-20240412222732 | 2 / 1 |
v1.3.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (aws-amplify-data-runtime) than the most recent previously approved version (aws-amplify-ops) on 2026-07-15, but aws-amplify-data-runtime is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.