← Home

@guardian/cdk

npm Repository Homepage

Generic Guardian flavoured AWS CDK components

32
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

guardian-developerscoldlinkakash1810reettaandrew.howe-elysndrsashcorrguardian

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:shady-links-raw-ip AI (semgrep): 169.254.169.254 is the AWS EC2 instance metadata endpoint; standard usage in CDK user-data scripts. ai
semgrep semgrep:child-process-import AI (semgrep): exec utility copied from aws-cdk for CLI tooling; not a supply-chain risk for this package. ai

Versions (showing 32 of 32)

Version Deps Published
64.0.0 9 / 21
63.6.2 9 / 21
63.6.1 9 / 21
63.6.0 9 / 21
63.5.1 9 / 21
63.5.0 9 / 21
63.4.0 9 / 21
63.3.1 9 / 21
63.3.0 9 / 21
63.2.1 9 / 21
63.2.0 9 / 21
63.1.0 9 / 21
63.0.1 9 / 21
63.0.0 9 / 21
62.6.1 9 / 21
62.6.0 9 / 21
62.5.4 9 / 21
62.5.3 9 / 21
62.5.2 9 / 21
62.5.1 9 / 21
62.5.0 9 / 22
62.4.0 10 / 22
62.3.5 10 / 22
62.3.4 10 / 22
62.3.3 10 / 22
62.3.2 10 / 22
62.3.1 10 / 22
62.3.0 10 / 22
62.2.1 10 / 22
62.2.0 10 / 22
62.1.3 10 / 22
62.1.2 10 / 22

v64.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v63.6.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v63.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.