@cdktn/commons
CDK Terrain Common utilities
8
Versions
MPL-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
cdktn-teamjsteinichso0k
Keywords
cdkcdktfcdktnterraform
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:build/util.test.js | AI (source-diff): Compiled test file with hex-encoded test payloads; readable TypeScript output, not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Package migrated to GitHub Actions CI publishing with SLSA attestation; this is the expected pattern for this org. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): jsteinich is a known contributor in the open-constructs org; addition consistent with legitimate team expansion. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env-spread is used to pass process.env to a child process exec call — standard pattern, not exfiltration. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads a resolved JSON file path, not arbitrary user input; stable false positive for this package. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 0.23.4 | 11 / 7 | |
| 0.23.3 | 11 / 6 | |
| 0.23.2 | 11 / 6 | |
| 0.23.1 | 11 / 8 | |
| 0.23.0 | 11 / 8 | |
| 0.22.1 | 11 / 17 | |
| 0.22.0 | 11 / 17 | |
| 0.21.0 | 11 / 17 |
v0.23.4
2 findings
HIGH
New obfuscated file: build/util.test.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.