@aws-cdk/aws-autoscaling
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:constructs | AI (phantom-deps): jsii peer dep used via generated code, not direct import. | ai | |
| npm-metadata | url-dep:pkglint | AI (npm-metadata): Monorepo-internal build tool, standard for aws-cdk packages. | ai | |
| npm-metadata | url-dep:cfn2ts | AI (npm-metadata): Monorepo-internal build tool, standard for aws-cdk packages. | ai | |
| npm-metadata | url-dep:cdk-build-tools | AI (npm-metadata): Monorepo-internal build tool, standard for aws-cdk packages. | ai | |
| npm-metadata | url-dep:cdk-integ-tools | AI (npm-metadata): Monorepo-internal build tool, standard for aws-cdk packages. | ai | |
| source-diff | obfuscated-file:lib/volume.js | AI (source-diff): Readable compiled JS with a long line, not obfuscation; AWS CDK official package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Expected pattern for synchronized monorepo releases from aws-cdk-team. | ai | |
| source-diff | obfuscated-file:.warnings.jsii.js | AI (source-diff): Standard jsii-generated deprecation warning file, present across all @aws-cdk packages. | ai | |
| dependencies | unvetted-dep:@aws-cdk/core | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai | |
| provenance | no-provenance | AI (provenance): AWS CDK v1 is EOL; provenance attestation was not standard practice during its active development. Publisher is the official aws-cdk-team with strong track record. | ai | |
| dependencies | unvetted-dep:@aws-cdk/aws-ec2 | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai | |
| dependencies | unvetted-dep:@aws-cdk/aws-iam | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai | |
| dependencies | unvetted-dep:@aws-cdk/aws-sns | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai | |
| dependencies | unvetted-dep:@aws-cdk/aws-cloudwatch | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai | |
| dependencies | unvetted-dep:@aws-cdk/aws-autoscaling-common | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai | |
| dependencies | unvetted-dep:@aws-cdk/aws-elasticloadbalancing | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai | |
| dependencies | unvetted-dep:@aws-cdk/aws-elasticloadbalancingv2 | AI (dependencies): Sibling AWS CDK v1 package published by the same trusted aws-cdk-team publisher; unvetted status reflects pipeline ordering, not actual risk. | ai |
Versions (showing 51 of 102)
| Version | Deps | Published |
|---|---|---|
| 1.204.0 | 9 / 9 | |
| 1.149.0 | 9 / 9 | |
| 1.148.0 | 9 / 9 | |
| 1.147.0 | 9 / 9 | |
| 1.146.0 | 9 / 9 | |
| 1.145.0 | 9 / 9 | |
| 1.144.0 | 9 / 9 | |
| 1.143.0 | 9 / 9 | |
| 1.142.0 | 9 / 9 | |
| 1.141.0 | 9 / 9 | |
| 1.140.0 | 9 / 9 | |
| 1.139.0 | 9 / 9 | |
| 1.138.2 | 9 / 9 | |
| 1.138.1 | 9 / 9 | |
| 1.138.0 | 9 / 9 | |
| 1.137.0 | 9 / 9 | |
| 1.136.0 | 9 / 9 | |
| 1.135.0 | 9 / 9 | |
| 1.134.0 | 9 / 9 | |
| 1.133.0 | 9 / 9 | |
| 1.132.0 | 9 / 9 | |
| 1.131.0 | 9 / 9 | |
| 1.130.0 | 9 / 9 | |
| 1.129.0 | 9 / 9 | |
| 1.128.0 | 9 / 9 | |
| 1.127.0 | 9 / 9 | |
| 1.126.0 | 9 / 9 | |
| 1.125.0 | 9 / 9 | |
| 1.124.0 | 9 / 9 | |
| 1.123.0 | 9 / 9 | |
| 1.122.0 | 9 / 9 | |
| 1.121.0 | 9 / 9 | |
| 1.120.0 | 9 / 9 | |
| 1.119.0 | 9 / 9 | |
| 1.118.0 | 9 / 9 | |
| 1.117.0 | 9 / 9 | |
| 1.116.0 | 9 / 9 | |
| 1.115.0 | 9 / 9 | |
| 1.114.0 | 9 / 9 | |
| 1.113.0 | 9 / 9 | |
| 1.112.0 | 9 / 9 | |
| 1.111.0 | 9 / 9 | |
| 1.110.1 | 9 / 9 | |
| 1.110.0 | 9 / 9 | |
| 1.109.0 | 9 / 9 | |
| 1.108.1 | 9 / 9 | |
| 1.77.0 | 9 / 8 | |
| 1.76.0 | 9 / 8 | |
| 1.75.0 | 9 / 8 | |
| 1.74.0 | 9 / 8 | |
| 1.73.0 | 9 / 8 |
v1.149.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.148.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.147.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.146.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.145.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.144.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.143.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.142.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.141.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.140.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.139.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.138.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.138.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.138.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.137.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.136.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.135.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.134.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.133.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.132.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.131.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.130.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.129.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.128.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.127.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.126.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.125.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.124.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.123.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.122.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.121.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.120.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.119.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.118.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.117.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.116.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.115.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.114.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.113.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.112.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.111.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.110.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.110.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.109.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.108.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.77.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.76.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.75.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.74.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.73.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.