@middy/sts
STS (Security Token Service) credentials middleware for the middy framework
35
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
lmamminomiddyjswillfarrell
Keywords
LambdaMiddlewareServerlessFrameworkAWSAWS LambdaMiddySTSSecurity Token ServiceCredentials
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation via Sigstore; missing gitHead is a cosmetic CI config change, not a supply-chain risk. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Established middy monorepo package with 191 versions; dormancy pattern is a false positive for scoped packages published in batches. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): @middy/sts is a legitimate scoped AWS STS middleware package, not a typosquat of 'qs'. | ai |
Versions (showing 35 of 35)
| Version | Deps | Published |
|---|---|---|
| 7.7.2 | 1 / 5 | |
| 7.7.0 | 1 / 5 | |
| 7.6.8 | 1 / 5 | |
| 7.6.7 | 1 / 5 | |
| 7.6.6 | 1 / 5 | |
| 7.6.5 | 1 / 5 | |
| 7.6.4 | 1 / 5 | |
| 7.6.3 | 1 / 5 | |
| 7.6.2 | 1 / 5 | |
| 7.6.1 | 1 / 5 | |
| 7.6.0 | 1 / 5 | |
| 7.5.0 | 1 / 5 | |
| 7.4.0 | 1 / 5 | |
| 7.3.4 | 1 / 5 | |
| 7.3.3 | 1 / 5 | |
| 7.3.2 | 1 / 5 | |
| 7.3.1 | 1 / 5 | |
| 7.3.0 | 1 / 5 | |
| 7.2.3 | 1 / 5 | |
| 7.2.2 | 1 / 5 | |
| 7.2.1 | 1 / 5 | |
| 7.2.0 | 1 / 5 | |
| 7.1.8 | 1 / 5 | |
| 7.1.7 | 1 / 5 | |
| 7.1.6 | 1 / 5 | |
| 7.1.5 | 1 / 5 | |
| 7.1.4 | 1 / 5 | |
| 7.1.3 | 1 / 5 | |
| 7.1.2 | 1 / 4 | |
| 7.1.1 | 1 / 4 | |
| 7.1.0 | 1 / 4 | |
| 7.0.3 | 1 / 4 | |
| 7.0.2 | 1 / 4 | |
| 7.0.1 | 1 / 4 | |
| 7.0.0 | 1 / 4 |
v7.7.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.