@aws-cdk/custom-resources

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

romainmulleramzn-ossrix0rrraws-cdk-team

Keywords

awscdkconstructscloudformationcustom-resourcescustomresources

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@aws-cdk/aws-stepfunctions-tasks	AI (dependencies): Same-org sibling CDK package, pinned exact version.	ai	2026/07/21
npm-metadata	url-dep:cdk-build-tools	AI (npm-metadata): Monorepo dev-tool file reference, standard for aws-cdk packages.	ai	2026/07/21
npm-metadata	url-dep:cfn2ts	AI (npm-metadata): Monorepo dev-tool file reference, standard for aws-cdk packages.	ai	2026/07/21
npm-metadata	url-dep:pkglint	AI (npm-metadata): Monorepo dev-tool file reference, standard for aws-cdk packages.	ai	2026/07/21
npm-metadata	url-dep:cdk-integ-tools	AI (npm-metadata): Monorepo dev-tool file reference, standard for aws-cdk packages.	ai	2026/07/21
source-diff	obfuscated-file:test/cdk.out/asset.5d5280180ad87e8a1c2a08423cb5b2dae41281832799cd51db5eff913091ade6/cfn-response.js	AI (source-diff): Transpiled test fixture asset, not real obfuscation or malicious code.	ai	2026/07/21
phantom-deps	phantom-dep:constructs	AI (phantom-deps): Used via CDK construct patterns, standard for this ecosystem.	ai	2026/07/21
semgrep	semgrep:child-process-import	AI (semgrep): child_process is used in the CDK custom resource Lambda runtime handler for legitimate SDK installation/invocation — standard pattern for this package.	ai	2026/04/26
semgrep	semgrep:http-module-request	AI (semgrep): HTTPS request is the required CloudFormation custom resource response mechanism (sending response to pre-signed S3 URL) — not exfiltration.	ai	2026/04/26
phantom-deps	phantom-dep:@aws-cdk/aws-sns	AI (phantom-deps): Same-org @aws-cdk scoped package; declared as dependency for type/construct usage, not a supply chain risk.	ai	2026/04/26

Versions (showing 100 of 219)

Version	Deps	Published
1.115.0	8 / 17	2021-07-21
1.114.0	8 / 17	2021-07-15
1.113.0	8 / 17	2021-07-12
1.112.0	8 / 17	2021-07-09
1.111.0	8 / 17	2021-07-02
1.110.1	8 / 17	2021-06-28
1.110.0	8 / 17	2021-06-24
1.109.0	8 / 17	2021-06-17
1.108.1	8 / 17	2021-06-11
1.108.0	8 / 17	2021-06-09
1.107.0	8 / 17	2021-06-02
1.106.1	8 / 17	2021-05-26
1.106.0	8 / 17	2021-05-25
1.105.0	8 / 17	2021-05-19
1.104.0	8 / 17	2021-05-15
1.103.0	8 / 17	2021-05-10
1.102.0	8 / 17	2021-05-04
1.101.0	8 / 17	2021-04-28
1.100.0	8 / 16	2021-04-20
1.99.0	8 / 16	2021-04-19
1.98.0	8 / 16	2021-04-12
1.97.0	8 / 16	2021-04-06
1.96.0	8 / 16	2021-04-01
1.95.2	8 / 16	2021-04-01
1.95.1	8 / 16	2021-03-26
1.95.0	8 / 16	2021-03-25
1.94.1	8 / 16	2021-03-17
1.94.0	8 / 16	2021-03-16
1.93.0	8 / 16	2021-03-11
1.92.0	8 / 16	2021-03-06
1.91.0	8 / 16	2021-02-23
1.90.1	8 / 16	2021-02-19
1.90.0	8 / 16	2021-02-17
1.89.0	8 / 16	2021-02-09
1.88.0	8 / 16	2021-02-04
1.87.1	8 / 16	2021-01-28
1.87.0	8 / 16	2021-01-27
1.86.0	8 / 16	2021-01-21
1.85.0	8 / 16	2021-01-14
1.84.0	8 / 16	2021-01-12
1.83.0	8 / 16	2021-01-06
1.82.0	8 / 16	2021-01-03
1.81.0	8 / 16	2020-12-31
1.80.0	8 / 16	2020-12-22
1.79.0	7 / 16	2020-12-17
1.78.0	7 / 16	2020-12-12
1.77.0	7 / 16	2020-12-07
1.76.0	7 / 16	2020-12-01
1.75.0	7 / 16	2020-11-24
1.74.0	7 / 16	2020-11-17
1.73.0	7 / 16	2020-11-11
1.72.0	7 / 16	2020-11-06
1.71.0	7 / 16	2020-10-29
1.70.0	7 / 16	2020-10-24
1.69.0	7 / 16	2020-10-19
1.68.0	7 / 16	2020-10-15
1.67.0	7 / 16	2020-10-07
1.66.0	7 / 16	2020-10-02
1.65.0	7 / 16	2020-10-01
1.64.1	7 / 16	2020-09-25
1.64.0	7 / 16	2020-09-24
1.63.0	7 / 16	2020-09-14
1.62.0	7 / 16	2020-09-04
1.61.1	7 / 16	2020-08-28
1.61.0	7 / 16	2020-08-27
1.60.0	7 / 16	2020-08-20
1.59.0	7 / 16	2020-08-15
1.58.0	7 / 16	2020-08-12
1.57.0	7 / 16	2020-08-07
1.56.0	7 / 16	2020-08-01
1.55.0	7 / 16	2020-07-28
1.54.0	7 / 16	2020-07-22
1.53.0	7 / 16	2020-07-20
1.52.0	7 / 16	2020-07-18
1.51.0	7 / 16	2020-07-09
1.50.0	7 / 16	2020-07-07
1.49.1	7 / 16	2020-07-02
1.49.0	7 / 16	2020-07-02
1.48.0	7 / 16	2020-07-01
1.47.1	7 / 16	2020-06-30
1.46.0	7 / 16	2020-06-20
1.45.0	7 / 16	2020-06-09
1.44.0	7 / 16	2020-06-04
1.43.0	7 / 16	2020-06-04
1.42.1	7 / 16	2020-06-01
1.42.0	7 / 16	2020-05-27
1.41.0	7 / 16	2020-05-21
1.40.0	7 / 16	2020-05-20
1.39.0	7 / 16	2020-05-16
1.38.0	7 / 16	2020-05-08
1.37.0	7 / 16	2020-05-05
1.36.1	7 / 16	2020-04-29
1.36.0	7 / 16	2020-04-28
1.35.0	7 / 16	2020-04-24
1.34.1	7 / 16	2020-04-22
1.34.0	7 / 16	2020-04-21
1.33.1	7 / 16	2020-04-19
1.33.0	7 / 16	2020-04-17
1.19.0	7 / 14	2019-12-17
1.16.0	7 / 14	2019-11-11

Showing 100 of 219 Next page →

v1.115.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.114.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.113.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.112.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.111.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.110.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.110.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.109.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.108.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.108.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.107.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.106.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.106.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.105.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.104.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.103.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.102.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.101.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.100.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.99.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.98.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.97.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.96.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.95.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.95.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.95.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.94.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.94.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.93.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.92.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.91.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.90.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.90.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.89.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.88.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.87.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.87.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.86.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.85.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.84.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.83.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.82.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.81.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.80.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.79.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.78.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.77.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.76.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.75.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.74.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.73.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.72.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.71.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.70.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.69.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.68.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.67.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.66.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.65.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.64.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.64.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.63.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.62.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.61.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.61.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.60.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.59.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.58.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.57.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.56.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.55.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.54.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.53.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.52.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.51.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.50.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.49.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.49.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.48.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.47.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.46.0

6 findings

HIGH New obfuscated file: test/cdk.out/asset.5d5280180ad87e8a1c2a08423cb5b2dae41281832799cd51db5eff913091ade6/cfn-response.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: test/cdk.out/asset.5d5280180ad87e8a1c2a08423cb5b2dae41281832799cd51db5eff913091ade6/framework.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: test/cdk.out/asset.5d5280180ad87e8a1c2a08423cb5b2dae41281832799cd51db5eff913091ade6/outbound.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: test/cdk.out/asset.a75563f489fb6bc4064bc85b91ef607f671326e647bcd9d9bcab0731de62edd4/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: test/cdk.out/asset.fd43c0b4c0b961743009872f92ea51e922be342a344c19b9a8dd693f494d8da2/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.45.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.44.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.43.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.42.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.42.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.41.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.38.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.34.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.34.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.33.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.33.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.19.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.