← Home

@cdktf/provider-generator

npm Repository Homepage

Exposes API to generate Terraform CDK provider bindings

1
Versions
MPL-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

cdktf-teamansgardschmidtnara

Keywords

cdkcdktfterraform

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:child-process-import AI (semgrep): Test harness invoking terraform binary; benign for this build tool. ai
dependencies unvetted-dep:@cdktf/provider-schema AI (dependencies): First-party @cdktf sibling pinned to same version. ai

Versions (showing 1 of 1)

Version Deps Published
0.21.0 6 / 9

v0.21.0

2 findings
HIGH child-process-import: lib/get/__tests__/generator/module-generator.test.js:34 semgrep

child_process imported — can execute arbitrary system commands 32 | const constructs_maker_1 = require("../../constructs-maker"); 33 | const util_1 = require("../util"); > 34 | const child_process_1 = require("child_process"); 35 | const onTf1_6AndNewer = (name, fn, timeout) => { 36 | const terraformBinaryName = process.env.TERRAFORM_BINARY_NAME || "terraform";

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.