@aws-cdk/aws-ecr-assets No license 42 versions

@aws-cdk/aws-ecr-assets

npm Repository Homepage

42

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

romainmulleramzn-ossrix0rrraws-cdk-team

Keywords

awscdkconstructsassetsdocker

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@aws-cdk/cx-api	AI (phantom-deps): Monorepo peer dependency; stable pattern for AWS CDK packages.	ai	2026/07/21
phantom-deps	phantom-dep:@aws-cdk/aws-lambda	AI (phantom-deps): Monorepo peer dependency; stable pattern for AWS CDK packages.	ai	2026/07/21
phantom-deps	phantom-dep:@aws-cdk/aws-cloudformation	AI (phantom-deps): Monorepo peer dependency; stable pattern for AWS CDK packages.	ai	2026/07/21
semgrep	semgrep:http-module-request	AI (semgrep): CFN custom-resource handler responding to pre-signed S3 URL, not exfil.	ai	2026/07/21
npm-metadata	url-dep:cdk-build-tools	AI (npm-metadata): Monorepo-internal tool ref, standard for aws-cdk packages.	ai	2026/07/21
npm-metadata	url-dep:cdk-integ-tools	AI (npm-metadata): Monorepo-internal tool ref, standard for aws-cdk packages.	ai	2026/07/21
npm-metadata	url-dep:pkglint	AI (npm-metadata): Monorepo-internal tool ref, standard for aws-cdk packages.	ai	2026/07/21
source-diff	obfuscated-file:lib/tarball-asset.js	AI (source-diff): Compiled jsii/TS output with long single-statement lines, not real obfuscation.	ai	2026/07/21
phantom-deps	phantom-dep:minimatch	AI (phantom-deps): Bundled dependency used internally by build tooling, not a malicious phantom dep.	ai	2026/07/21
publish-pattern	dormant-publish	AI (publish-pattern): Normal AWS CDK v1 maintenance cadence from a long-trusted publisher.	ai	2026/07/21
dependencies	unvetted-dep:@aws-cdk/assets	AI (dependencies): Sibling package in the AWS CDK v1 monorepo, published by the same trusted aws-cdk-team at the same version. No risk.	ai	2026/04/26
phantom-deps	phantom-dep:@aws-cdk/aws-iam	AI (phantom-deps): Same as aws-s3: jsii CDK monorepo pattern; dependency is legitimately declared and used transitively.	ai	2026/04/26
phantom-deps	phantom-dep:@aws-cdk/aws-s3	AI (phantom-deps): jsii CDK packages use dependencies via type re-exports and transitive usage; not directly imported does not indicate a phantom dep risk in this monorepo context.	ai	2026/04/26

Versions (showing 42 of 242)

Version	Deps	Published
1.32.1	10 / 9	2020-04-09
1.32.0	10 / 9	2020-04-07
1.31.0	10 / 9	2020-03-24
1.30.0	10 / 9	2020-03-18
1.29.0	10 / 9	2020-03-18
1.28.0	9 / 9	2020-03-16
1.27.0	9 / 9	2020-03-03
1.26.0	9 / 9	2020-02-26
1.25.0	9 / 9	2020-02-19
1.24.0	9 / 9	2020-02-14
1.23.0	9 / 9	2020-02-07
1.22.0	8 / 9	2020-01-23
1.21.1	8 / 9	2020-01-16
1.21.0	8 / 9	2020-01-16
1.20.0	8 / 9	2020-01-08
1.19.0	8 / 7	2019-12-17
1.18.0	8 / 7	2019-11-25
1.17.1	8 / 7	2019-11-19
1.17.0	8 / 7	2019-11-19
1.16.3	8 / 7	2019-11-13
1.16.2	8 / 7	2019-11-12
1.16.1	8 / 7	2019-11-12
1.16.0	8 / 7	2019-11-11
1.15.0	8 / 7	2019-10-28
1.14.0	8 / 7	2019-10-22
1.13.1	8 / 7	2019-10-15
1.13.0	8 / 7	2019-10-15
1.12.0	8 / 7	2019-10-07
1.11.0	8 / 7	2019-10-02
1.10.1	8 / 7	2019-10-01
1.10.0	8 / 7	2019-09-30
1.9.0	8 / 7	2019-09-20
1.8.0	8 / 7	2019-09-10
1.7.0	8 / 7	2019-09-06
1.6.1	8 / 7	2019-08-29
1.6.0	8 / 7	2019-08-27
1.5.0	8 / 7	2019-08-21
1.4.0	8 / 7	2019-08-14
1.3.0	8 / 7	2019-08-02
1.2.0	8 / 7	2019-07-25
1.1.0	8 / 7	2019-07-19
1.0.0	8 / 7	2019-07-11

v1.32.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.28.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.27.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.21.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.21.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.20.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.19.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.18.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.17.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.17.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.16.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.16.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.16.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.