@aws-sdk/middleware-websocket
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): aws-sdk-bot is the canonical AWS SDK automation account with 34k+ approved packages; dormancy in a stable middleware package followed by a routine update is not a takeover signal. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard implicit dependency in AWS SDK monorepo packages; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/types | AI (phantom-deps): Framework-scoped AWS SDK types package loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@smithy/util-utf8 | AI (phantom-deps): First-party Smithy utility package loaded by convention in the AWS SDK monorepo; stable false positive. | ai |
Versions (showing 100 of 106)
| Version | Deps | Published |
|---|---|---|
| 3.972.40 | 7 / 7 | |
| 3.972.39 | 7 / 7 | |
| 3.972.38 | 7 / 7 | |
| 3.972.37 | 7 / 7 | |
| 3.972.36 | 7 / 7 | |
| 3.972.35 | 7 / 7 | |
| 3.972.34 | 7 / 7 | |
| 3.972.33 | 7 / 7 | |
| 3.972.32 | 7 / 7 | |
| 3.972.31 | 7 / 7 | |
| 3.972.30 | 7 / 7 | |
| 3.972.29 | 7 / 7 | |
| 3.972.28 | 7 / 7 | |
| 3.972.27 | 7 / 7 | |
| 3.972.26 | 7 / 7 | |
| 3.972.25 | 7 / 7 | |
| 3.972.24 | 7 / 7 | |
| 3.972.23 | 7 / 7 | |
| 3.972.22 | 7 / 7 | |
| 3.972.21 | 7 / 7 | |
| 3.972.20 | 7 / 7 | |
| 3.972.19 | 7 / 7 | |
| 3.972.18 | 7 / 7 | |
| 3.972.17 | 7 / 7 | |
| 3.972.16 | 12 / 7 | |
| 3.972.15 | 12 / 7 | |
| 3.972.14 | 12 / 7 | |
| 3.972.13 | 12 / 7 | |
| 3.972.12 | 12 / 7 | |
| 3.972.11 | 12 / 7 | |
| 3.972.10 | 12 / 7 | |
| 3.972.9 | 12 / 7 | |
| 3.972.8 | 12 / 7 | |
| 3.972.7 | 12 / 7 | |
| 3.972.6 | 12 / 7 | |
| 3.972.5 | 12 / 7 | |
| 3.972.4 | 10 / 7 | |
| 3.972.3 | 10 / 8 | |
| 3.972.2 | 10 / 8 | |
| 3.972.1 | 10 / 8 | |
| 3.972.0 | 10 / 8 | |
| 3.971.0 | 10 / 8 | |
| 3.969.0 | 10 / 8 | |
| 3.968.0 | 10 / 8 | |
| 3.965.0 | 10 / 8 | |
| 3.957.0 | 10 / 8 | |
| 3.956.0 | 10 / 8 | |
| 3.953.0 | 10 / 8 | |
| 3.936.0 | 10 / 8 | |
| 3.930.0 | 10 / 8 | |
| 3.922.0 | 10 / 8 | |
| 3.921.0 | 10 / 8 | |
| 3.920.0 | 10 / 8 | |
| 3.914.0 | 10 / 8 | |
| 3.910.0 | 10 / 8 | |
| 3.908.0 | 10 / 8 | |
| 3.901.0 | 10 / 8 | |
| 3.893.0 | 10 / 8 | |
| 3.891.0 | 10 / 8 | |
| 3.890.0 | 10 / 8 | |
| 3.887.0 | 10 / 8 | |
| 3.873.0 | 10 / 8 | |
| 3.862.0 | 10 / 8 | |
| 3.844.0 | 10 / 8 | |
| 3.840.0 | 10 / 8 | |
| 3.821.0 | 10 / 8 | |
| 3.804.0 | 10 / 8 | |
| 3.796.0 | 10 / 8 | |
| 3.775.0 | 10 / 8 | |
| 3.734.0 | 10 / 8 | |
| 3.733.0 | 10 / 8 | |
| 3.731.0 | 10 / 8 | |
| 3.723.0 | 10 / 8 | |
| 3.714.0 | 10 / 8 | |
| 3.713.0 | 10 / 8 | |
| 3.709.0 | 11 / 8 | |
| 3.696.0 | 11 / 8 | |
| 3.693.0 | 11 / 8 | |
| 3.692.0 | 11 / 8 | |
| 3.691.0 | 11 / 8 | |
| 3.686.0 | 11 / 8 | |
| 3.682.0 | 11 / 8 | |
| 3.679.0 | 11 / 8 | |
| 3.674.0 | 11 / 8 | |
| 3.667.0 | 11 / 9 | |
| 3.664.0 | 11 / 9 | |
| 3.662.0 | 11 / 9 | |
| 3.658.1 | 11 / 9 | |
| 3.654.0 | 11 / 9 | |
| 3.649.0 | 11 / 9 | |
| 3.629.0 | 11 / 9 | |
| 3.621.0 | 11 / 9 | |
| 3.620.0 | 11 / 9 | |
| 3.616.0 | 11 / 9 | |
| 3.614.0 | 11 / 9 | |
| 3.613.0 | 11 / 9 | |
| 3.609.0 | 11 / 9 | |
| 3.605.0 | 11 / 9 | |
| 3.598.0 | 11 / 9 | |
| 3.587.0 | 11 / 9 |
v3.972.40
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.39
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.38
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.37
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.36
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.35
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.34
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.30
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.972.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.972.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.972.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.914.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.910.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.908.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.893.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.891.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.862.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.844.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.840.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.821.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.804.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.796.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.775.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.734.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.733.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.731.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.723.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.714.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.713.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.709.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.696.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.693.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.692.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.691.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.686.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.682.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.679.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.674.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.667.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.664.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.662.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.658.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.654.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.649.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.629.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.621.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.620.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.616.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.614.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.613.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.609.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.605.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.598.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.587.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.