amazon-cognito-identity-js
Amazon Cognito Identity Provider JavaScript SDK
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| license | uncommon-license:SEE LICENSE IN LICENSE.txt | AI (license): Amazon Software License is a known AWS license; this flag is a stable false positive for all AWS SDK packages. | ai | |
| provenance | missing-githead | AI (provenance): AWS SDK package with legitimate maintainer transition; missing gitHead reflects build environment change during team handoff, not a malicious publish. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Binaries are Android/React Native build artifacts (Facebook React Native, WebKit JSC) from the bundled example app — expected for this React Native SDK package. | ai | |
| source-diff | encoded-string-file:dist/amazon-cognito-identity.js | AI (source-diff): Long string is standard webpack UMD bundle output. This package ships pre-built dist files as part of its design; not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Both itrestian and mlabieniec are Amazon employees listed in package.json contributors; this is a legitimate internal AWS maintainer transition, not a hostile takeover. | ai | |
| source-diff | encoded-string-file:dist/amazon-cognito-identity.min.js | AI (source-diff): Long string is standard webpack minified UMD bundle output. Expected artifact for this package's build process. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of mattsb42-aws alongside addition of other AWS Amplify accounts reflects normal team rotation, not a package takeover. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @aws-crypto/sha256-js is AWS's own cryptography library, replacing crypto-js. This is a well-known, security-motivated dependency change in AWS SDKs. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are all AWS Amplify organizational accounts, consistent with normal team rotation within AWS. Not a hostile takeover signal. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding is core to SRP authentication in Cognito SDK (AuthenticationHelper). Legitimate cryptographic use, not obfuscation. | ai | |
| provenance | no-provenance | AI (provenance): Established AWS Amplify package predating widespread Sigstore adoption; publisher identity is well-established through long track record. | ai | |
| semgrep | semgrep:toplevel-fetch | AI (semgrep): fetch() calls are the core HTTP transport for Cognito API requests — the fundamental purpose of this SDK. Not exfiltration. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is used to parse JWT token payloads (CognitoJwtToken). Standard and expected for a JWT-handling authentication library. | ai |
Versions (showing 100 of 117)
| Version | Deps | Published |
|---|---|---|
| 6.3.20 | 5 / 6 | |
| 6.3.19 | 5 / 6 | |
| 6.3.18 | 5 / 6 | |
| 6.3.17 | 5 / 6 | |
| 6.3.16 | 5 / 6 | |
| 6.3.15 | 5 / 6 | |
| 6.3.14 | 5 / 6 | |
| 6.3.13 | 5 / 6 | |
| 6.3.12 | 5 / 6 | |
| 6.3.11 | 5 / 6 | |
| 6.3.10 | 5 / 6 | |
| 6.3.9 | 5 / 6 | |
| 6.3.8 | 5 / 6 | |
| 6.3.7 | 5 / 6 | |
| 6.3.6 | 5 / 6 | |
| 6.3.5 | 5 / 6 | |
| 6.3.4 | 5 / 6 | |
| 6.3.3 | 5 / 6 | |
| 6.3.2 | 5 / 6 | |
| 6.3.1 | 5 / 21 | |
| 6.3.0 | 5 / 21 | |
| 6.2.0 | 5 / 21 | |
| 6.1.2 | 5 / 21 | |
| 6.1.1 | 5 / 21 | |
| 6.1.0 | 5 / 21 | |
| 6.0.1 | 5 / 21 | |
| 6.0.0 | 5 / 21 | |
| 5.0.1 | 5 / 20 | |
| 5.0.0 | 5 / 20 | |
| 4.6.3 | 5 / 19 | |
| 4.6.1 | 5 / 19 | |
| 4.5.1 | 4 / 18 | |
| 4.5.0 | 4 / 18 | |
| 4.4.0 | 4 / 18 | |
| 4.3.5 | 3 / 18 | |
| 4.3.4 | 3 / 18 | |
| 4.3.3 | 3 / 18 | |
| 4.3.2 | 3 / 18 | |
| 4.3.1 | 3 / 18 | |
| 4.3.0 | 3 / 18 | |
| 4.2.4 | 3 / 18 | |
| 4.2.3 | 3 / 18 | |
| 4.2.2 | 3 / 18 | |
| 4.2.1 | 3 / 18 | |
| 4.2.0 | 3 / 18 | |
| 4.1.0 | 3 / 18 | |
| 3.3.3 | 3 / 21 | |
| 3.3.0 | 3 / 21 | |
| 3.2.7 | 3 / 18 | |
| 3.2.6 | 3 / 18 | |
| 3.2.5 | 3 / 18 | |
| 3.2.4 | 3 / 18 | |
| 3.2.3 | 3 / 18 | |
| 3.2.2 | 3 / 18 | |
| 3.2.1 | 3 / 18 | |
| 3.2.0 | 3 / 21 | |
| 3.1.3 | 3 / 21 | |
| 3.1.2 | 3 / 21 | |
| 3.1.0 | 3 / 21 | |
| 3.0.16 | 3 / 20 | |
| 3.0.15 | 3 / 20 | |
| 3.0.14 | 3 / 20 | |
| 3.0.13 | 3 / 20 | |
| 3.0.12 | 3 / 20 | |
| 3.0.11 | 3 / 20 | |
| 3.0.10 | 3 / 20 | |
| 3.0.9 | 3 / 20 | |
| 3.0.8 | 3 / 20 | |
| 3.0.7 | 3 / 20 | |
| 3.0.6 | 3 / 20 | |
| 3.0.5 | 3 / 20 | |
| 3.0.4 | 3 / 20 | |
| 3.0.3 | 3 / 20 | |
| 3.0.2 | 3 / 20 | |
| 3.0.1 | 3 / 20 | |
| 2.0.30 | 3 / 20 | |
| 2.0.29 | 3 / 20 | |
| 2.0.28 | 3 / 20 | |
| 2.0.27 | 3 / 20 | |
| 2.0.26 | 3 / 20 | |
| 2.0.25 | 3 / 20 | |
| 2.0.24 | 3 / 20 | |
| 2.0.23 | 3 / 20 | |
| 2.0.22 | 3 / 20 | |
| 2.0.21 | 3 / 20 | |
| 2.0.20 | 3 / 20 | |
| 2.0.19 | 3 / 20 | |
| 2.0.17 | 3 / 20 | |
| 2.0.16 | 3 / 20 | |
| 2.0.15 | 3 / 20 | |
| 2.0.14 | 3 / 20 | |
| 2.0.13 | 3 / 20 | |
| 2.0.12 | 3 / 20 | |
| 2.0.11 | 3 / 20 | |
| 2.0.10 | 3 / 20 | |
| 2.0.9 | 3 / 20 | |
| 2.0.8 | 3 / 20 | |
| 2.0.7 | 3 / 20 | |
| 2.0.2 | 3 / 20 | |
| 2.0.1 | 3 / 20 |
v6.3.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.