@aws-crypto/sha256-browser
SHA256 wrapper for browsers that prefers `window.crypto.subtle` but will fall back to a pure JS implementation in @aws-crypto/sha256-js to provide a consistent interface for SHA256.
15
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
amzn-ossseebeesagray256lavalerisalkeldraws-crypto-tools-ci-botmattsb42-awsfarleyb-aws
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@aws-crypto/ie11-detection | AI (dependencies): @aws-crypto/ie11-detection is an official AWS Crypto Tools package from the same monorepo and publisher; it is a legitimate dependency for this package across all versions. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from seebees to salkeldr reflects a legitimate AWS internal team transition; salkeldr has a strong track record (44 approved, 0 rejected) and the repo remains under the official aws GitHub org. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (salkeldr, agray256, jamesiri, lavaleri) are consistent with AWS team rotation; all additions align with the official AWS Crypto Tools ownership. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of jpeddicord alongside addition of multiple AWS team members is consistent with a legitimate internal handoff, not a takeover. | ai | |
| provenance | no-provenance | AI (provenance): Established AWS Crypto Tools package published by official AWS CI bot; lack of Sigstore provenance is expected for packages of this age and does not indicate risk. | ai | |
| dependencies | unvetted-dep:@aws-crypto/util | AI (dependencies): Sibling package from the same AWS Crypto Tools monorepo; unvetted status is a pipeline artifact, not a real risk. | ai | |
| dependencies | unvetted-dep:@aws-crypto/sha256-js | AI (dependencies): Sibling package from the same AWS Crypto Tools monorepo; unvetted status is a pipeline artifact, not a real risk. | ai | |
| phantom-deps | phantom-dep:@smithy/util-utf8 | AI (phantom-deps): AWS SDK ecosystem package loaded by convention; stable false positive for this package. | ai |