@cdklabs/cdk-cicd-wrapper-cli Apache-2.0 47 versions

@cdklabs/cdk-cicd-wrapper-cli

npm Repository Homepage

This repository contains the infrastructure as code to wrap your AWS CDK project with CI/CD around it.

47

Versions

Apache-2.0

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

cdklabs-automationaws-cdk-teamamzn-oss

Keywords

awsaws-cdkawscdkci-cdci-cd-bootclivanilla-pipeline

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	suspicious-initial-version	AI (npm-metadata): projen-managed repos commonly ship 0.0.0 placeholder version; trusted publisher.	ai	2026/07/10
bogus-package	bogus-package	AI (bogus-package): Sparse README is typical for internal cdklabs tooling, not spam.	ai	2026/07/10
source-diff	obfuscated-file:lib/cmds/license/NodeLicenseCollector.js	AI (source-diff): TS compiler helper boilerplate, not real obfuscation; no malicious behavior.	ai	2026/07/10
source-diff	obfuscated-file:lib/cmds/license/Projects.js	AI (source-diff): TS compiler helper boilerplate, not real obfuscation; no malicious behavior.	ai	2026/07/10
source-diff	obfuscated-file:lib/cmds/license/PythonLicenseCollector.js	AI (source-diff): TS compiler helper boilerplate, not real obfuscation; no malicious behavior.	ai	2026/07/10
phantom-deps	phantom-dep:@types/yargs	AI (phantom-deps): Type-only package used at compile time; not directly imported at runtime by design.	ai	2026/04/29
phantom-deps	phantom-dep:fs-extra	AI (phantom-deps): fs-extra is a declared runtime dependency; phantom-dep heuristic is a false positive here.	ai	2026/04/29
phantom-deps	phantom-dep:@types/fs-extra	AI (phantom-deps): Type-only package used at compile time; not directly imported at runtime by design.	ai	2026/04/29
semgrep	semgrep:child-process-import	AI (semgrep): CLI tool that orchestrates CI/CD commands; child_process use is inherent to its purpose.	ai	2026/04/29

Versions (showing 47 of 47)

Version	Deps	Published
0.2.28	9 / 13	2026-04-27
0.2.27	9 / 13	2026-04-27
0.2.26	9 / 13	2026-04-27
0.2.25	9 / 13	2026-04-20
0.2.24	9 / 13	2026-04-17
0.2.23	9 / 13	2026-04-16
0.2.22	9 / 13	2025-10-09
0.2.21	9 / 13	2025-05-12
0.2.20	9 / 14	2025-03-21
0.2.19	9 / 14	2025-03-18
0.2.18	9 / 14	2025-03-17
0.2.17	9 / 14	2025-01-27
0.2.16	9 / 14	2025-01-22
0.2.15	9 / 14	2025-01-03
0.2.14	9 / 14	2024-11-07
0.2.13	9 / 14	2024-10-03
0.2.12	9 / 14	2024-10-01
0.2.11	9 / 14	2024-09-25
0.2.10	9 / 14	2024-09-11
0.2.9	9 / 14	2024-09-03
0.2.8	9 / 14	2024-09-02
0.2.7	9 / 14	2024-08-29
0.2.6	9 / 14	2024-08-27
0.2.5	9 / 13	2024-08-22
0.2.4	8 / 13	2024-07-23
0.2.3	8 / 13	2024-07-23
0.2.2	8 / 13	2024-07-08
0.2.1	8 / 13	2024-06-27
0.2.0	8 / 13	2024-06-19
0.1.3	8 / 13	2024-06-05
0.1.2	8 / 13	2024-06-03
0.1.1	8 / 13	2024-05-31
0.1.0	8 / 13	2024-05-30
0.0.13	8 / 13	2024-05-27
0.0.12	8 / 13	2024-05-24
0.0.11	8 / 13	2024-05-23
0.0.10	8 / 13	2024-05-21
0.0.9	8 / 13	2024-05-17
0.0.8	8 / 13	2024-05-16
0.0.7	8 / 13	2024-05-15
0.0.6	8 / 13	2024-05-15
0.0.5	8 / 13	2024-05-13
0.0.4	8 / 13	2024-05-13
0.0.3	8 / 13	2024-05-09
0.0.2	8 / 13	2024-05-08
0.0.1	8 / 13	2024-05-08
0.0.0	8 / 13	2024-05-07

v0.2.20

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.19

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.18

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.17

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.16

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.15

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.14

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.13

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.12

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.11

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.10

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.9

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.8

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.7

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.6

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.5

4 findings

HIGH New obfuscated file: lib/cmds/license/NodeLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/Projects.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/cmds/license/PythonLicenseCollector.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.