aws-cdk-lib
Version 2 of the AWS Cloud Development Kit library
40
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
aws-cdk-team
Keywords
awscdkaws cdk v2
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep-scan-truncated | AI (phantom-deps): Large monorepo; scan budget exceeded is expected and not indicative of malice. | ai | |
| source-diff | obfuscated-file:testhelpers/jest-global-app-testhook.js | AI (source-diff): minified test helper; benign. | ai | |
| dependencies | unvetted-dep:@aws/cloudformation-validate | AI (dependencies): First-party AWS dependency backing the new validation plugin. | ai | |
| source-diff | obfuscated-file:core/lib/validation/cloudformation-validate-plugin.js | AI (source-diff): minified plugin wiring for CloudFormation validate engine. | ai | |
| source-diff | obfuscated-file:core/lib/private/synthesis-validation.js | AI (source-diff): minified first-party core build output. | ai | |
| source-diff | obfuscated-file:core/lib/private/deps.js | AI (source-diff): minified first-party core build output; benign construct dependency logic. | ai | |
| source-diff | obfuscated-file:aws-dataexchange/lib/dataexchange.generated.js | AI (source-diff): esbuild-minified jsii generated CFN code. | ai | |
| source-diff | obfuscated-file:aws-outposts/lib/outposts.generated.js | AI (source-diff): esbuild-minified jsii generated CFN code. | ai | |
| source-diff | obfuscated-file:aws-controlcatalog/lib/controlcatalog.generated.js | AI (source-diff): esbuild-minified jsii generated CFN code; standard aws-cdk-lib build output. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): WASM binding for @aws/cloudformation-validate rego engine; expected in this package. | ai | |
| semgrep | semgrep:http-module-request | AI (semgrep): HTTP in CDK log-retention Lambda handler; benign for this package. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval in first-party CDK stepfunctions Lambda handler; benign for this package. | ai | |
| source-diff | obfuscated-file:aws-resiliencehubv2/lib/resiliencehubv2.generated.js | AI (source-diff): Auto-generated CFN construct code minified by CDK build; stable pattern across all aws-cdk-lib versions. | ai | |
| source-diff | obfuscated-file:aws-bcm/lib/bcm.generated.js | AI (source-diff): Auto-generated CFN construct code minified by CDK build; stable pattern across all aws-cdk-lib versions. | ai | |
| source-diff | obfuscated-file:core/lib/cross-stack-reference-strength.js | AI (source-diff): Standard JSII-compiled TS output; long lines are normal for this package's build pipeline. | ai | |
| source-diff | obfuscated-file:aws-cloudwatch/lib/promql-alarm.js | AI (source-diff): JSII/lazify build output; standard CDK pattern. | ai | |
| source-diff | obfuscated-file:aws-chime/lib/chime.generated.js | AI (source-diff): Auto-generated CloudFormation L1 construct; minified output is normal for aws-cdk-lib. | ai | |
| source-diff | obfuscated-file:core/lib/helpers-internal/box.js | AI (source-diff): Minified build output from CDK's standard pipeline; no obfuscation or malicious payload. | ai | |
| source-diff | obfuscated-file:aws-kinesisfirehose/lib/record-format/output.js | AI (source-diff): Lazified build output; standard for this package. | ai | |
| source-diff | obfuscated-file:aws-kinesisfirehose/lib/record-format/index.js | AI (source-diff): Lazified module exports; standard build output for aws-cdk-lib. | ai | |
| source-diff | obfuscated-file:aws-memorydb/lib/memorydb-canned-metrics.generated.js | AI (source-diff): Auto-generated canned metrics file; standard CDK codegen output. | ai | |
| source-diff | obfuscated-file:aws-bedrock/lib/bedrock-canned-metrics.generated.js | AI (source-diff): Auto-generated canned metrics file; standard CDK codegen output. | ai | |
| source-diff | obfuscated-file:aws-bedrockagentcore/lib/bedrockagentcore.generated.js | AI (source-diff): Auto-generated CloudFormation L1 construct; standard CDK codegen output. | ai | |
| source-diff | obfuscated-file:aws-smsvoice/lib/smsvoice.generated.js | AI (source-diff): Auto-generated CloudFormation L1 construct; standard CDK codegen output. | ai | |
| source-diff | obfuscated-file:aws-rds/lib/proxy-endpoint.js | AI (source-diff): jsii-compiled CDK construct; long lines from standard build, not obfuscation. | ai | |
| source-diff | obfuscated-file:aws-odb/lib/odb.generated.js | AI (source-diff): Auto-generated CloudFormation L1 construct; long lines are normal. | ai | |
| source-diff | obfuscated-file:aws-apigatewayv2/lib/websocket/api-key.js | AI (source-diff): jsii-compiled output; standard for aws-cdk-lib build pipeline. | ai | |
| source-diff | obfuscated-file:aws-apigatewayv2/lib/websocket/usage-plan.js | AI (source-diff): jsii-compiled output; standard for aws-cdk-lib build pipeline. | ai | |
| source-diff | obfuscated-file:aws-billing/lib/billing.generated.js | AI (source-diff): Auto-generated CloudFormation L1 construct; long lines are normal. | ai | |
| source-diff | obfuscated-file:aws-observabilityadmin/lib/observabilityadmin.generated.js | AI (source-diff): jsii code-generated CloudFormation L1 construct; standard pattern for aws-cdk-lib. | ai | |
| source-diff | obfuscated-file:aws-logs/lib/transformer.js | AI (source-diff): jsii-compiled CDK construct code; long lines from build tooling, not obfuscation. | ai | |
| source-diff | obfuscated-file:aws-arcregionswitch/lib/arcregionswitch.generated.js | AI (source-diff): jsii code-generated CloudFormation L1 construct; long lines from minification, not obfuscation. | ai | |
| source-diff | obfuscated-file:aws-rds/lib/validate-database-insights.js | AI (source-diff): jsii-compiled validation logic; standard minified build output for aws-cdk-lib. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): semver is in bundleDependencies; used at runtime through the minified bundle, not a direct import. | ai | |
| source-diff | obfuscated-file:aws-directconnect/lib/directconnect.generated.js | AI (source-diff): CloudFormation L1 generated construct code; standard aws-cdk-lib build output. | ai | |
| source-diff | obfuscated-file:aws-mwaaserverless/lib/mwaaserverless.generated.js | AI (source-diff): JSII-compiled CDK CloudFormation resource definitions; standard minified build output. | ai | |
| source-diff | obfuscated-file:aws-kms/lib/key-grants.js | AI (source-diff): JSII-compiled CDK construct code; minified output is standard for aws-cdk-lib build pipeline. | ai | |
| source-diff | obfuscated-file:core/lib/private/stack-metadata.js | AI (source-diff): JSII-compiled CDK core module code; minified single-line JS is standard for this package. | ai | |
| source-diff | obfuscated-file:node_modules/@aws-cdk/cloud-assembly-api/lib/environment.js | AI (source-diff): Bundled cloud-assembly-api module; standard CDK source with long lines. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dep @aws-cdk/cloud-assembly-api is an official AWS CDK package from the same org; expected evolution. | ai | |
| source-diff | obfuscated-file:aws-computeoptimizer/lib/computeoptimizer.generated.js | AI (source-diff): Auto-generated CloudFormation resource definitions; standard CDK codegen output. | ai | |
| source-diff | obfuscated-file:aws-eks-v2/lib/cluster.js | AI (source-diff): Minified jsii build output for new EKS v2 module; standard CDK build artifact. | ai | |
| source-diff | obfuscated-file:node_modules/@aws-cdk/cloud-assembly-api/lib/artifacts/cloudformation-artifact.js | AI (source-diff): Official AWS CDK dependency; standard cloud assembly artifact code. | ai | |
| source-diff | obfuscated-file:node_modules/@aws-cdk/cloud-assembly-api/lib/cloud-assembly.js | AI (source-diff): Official AWS CDK dependency; long lines from class definitions, not obfuscation. | ai | |
| source-diff | obfuscated-file:node_modules/@aws-cdk/cloud-assembly-api/lib/cloud-artifact.js | AI (source-diff): Official AWS CDK dependency; long lines from class definitions, not obfuscation. | ai | |
| source-diff | obfuscated-file:aws-cases/lib/cases.generated.js | AI (source-diff): Auto-generated CloudFormation resource definitions; standard CDK codegen output. | ai | |
| source-diff | obfuscated-file:aws-s3/lib/mixins/bucket.js | AI (source-diff): Minified jsii build output for S3 bucket mixins; standard CDK build artifact. | ai | |
| source-diff | obfuscated-file:aws-bedrockmantle/lib/bedrockmantle.generated.js | AI (source-diff): Auto-generated CloudFormation resource definitions; standard CDK codegen output. | ai | |
| source-diff | obfuscated-file:aws-eks-v2/lib/addon.js | AI (source-diff): Minified jsii build output with TS decorator helpers; standard CDK build pipeline artifact. | ai | |
| source-diff | obfuscated-file:node_modules/@aws-cdk/cloud-assembly-api/lib/artifacts/asset-manifest-artifact.js | AI (source-diff): Actually readable formatted JS (not minified); official AWS CDK dependency. | ai | |
| source-diff | obfuscated-file:core/lib/mixins/applicator.js | AI (source-diff): Minified jsii build output with TS decorator helpers; core CDK module. | ai | |
| source-diff | obfuscated-file:aws-eks-v2/lib/alb-controller.js | AI (source-diff): Minified jsii build output; contains CDK version constants and lazy requires typical of CDK modules. | ai | |
| source-diff | obfuscated-file:aws-eks-v2/lib/access-entry.js | AI (source-diff): Minified jsii build output with TS decorator helpers; standard CDK build pipeline artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:node_modules/@aws-cdk/cloud-assembly-api/lib/assets.js | AI (source-diff): Readable formatted JS with long export lines; official AWS CDK dependency. | ai | |
| source-diff | large-new-source-files | AI (source-diff): aws-cdk-lib routinely adds new AWS service modules (e.g. aws-devopsagent) and expands existing ones; 23 new files is normal for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): aws-cdk-lib publishes frequently; dormancy signal is an artifact of comparing against last approved version, not actual publish cadence. | ai | |
| source-diff | obfuscated-file:aws-devopsagent/lib/devopsagent.generated.js | AI (source-diff): Auto-generated L1 CloudFormation construct from AWS service spec. Same pattern as all other .generated.js files in aws-cdk-lib. | ai | |
| source-diff | obfuscated-file:aws-lambda/lib/capacity-provider.js | AI (source-diff): Standard jsii-compiled TypeScript output with JSII_RTTI_SYMBOL, __esDecorate, jsiiDeprecationWarnings. Long lines are the jsii build pipeline artifact, not obfuscation. | ai | |
| phantom-deps | phantom-dep:ignore | AI (phantom-deps): Legitimate dependency used in CDK's dockerignore/gitignore handling; import hidden by minification. | ai | |
| provenance | no-provenance | AI (provenance): aws-cdk-lib historically publishes without provenance; trusted publisher with strong track record. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): CDK metadata resource uses base64 for analytics/metadata encoding; benign. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Minified CDK bundle uses dynamic require for lazy-loading modules; expected pattern. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CDK legitimately spawns build tools (esbuild, npm, etc.) for Lambda bundling. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): CDK's Lambda Node.js bundling legitimately passes env vars to esbuild subprocess. | ai | |
| phantom-deps | phantom-dep:@aws-cdk/asset-node-proxy-agent-v6 | AI (phantom-deps): First-party AWS CDK asset dependency; import hidden by minification. | ai | |
| phantom-deps | phantom-dep:@aws-cdk/cloud-assembly-api | AI (phantom-deps): First-party AWS CDK dependency; import hidden by minification. | ai | |
| phantom-deps | phantom-dep:@balena/dockerignore | AI (phantom-deps): Legitimate dependency for Docker asset bundling in CDK; import hidden by minification. | ai | |
| phantom-deps | phantom-dep:jsonschema | AI (phantom-deps): Legitimate dependency for CloudFormation schema validation; import hidden by minification. | ai | |
| phantom-deps | phantom-dep:minimatch | AI (phantom-deps): Legitimate dependency for glob matching in CDK; import hidden by minification. | ai | |
| phantom-deps | phantom-dep:punycode | AI (phantom-deps): Legitimate dependency for domain name handling in CDK; import hidden by minification. | ai | |
| phantom-deps | phantom-dep:table | AI (phantom-deps): Legitimate dependency of aws-cdk-lib used in minified bundle; scanner can't trace imports through bundled code. | ai |
Versions (showing 40 of 40)
| Version | Deps | Published |
|---|---|---|
| 2.262.1 | 15 / 53 | |
| 2.262.0 | 15 / 53 | |
| 2.261.0 | 14 / 52 | |
| 2.260.0 | 15 / 52 | |
| 2.258.1 | 15 / 52 | |
| 2.258.0 | 15 / 52 | |
| 2.254.0 | 15 / 51 | |
| 2.253.0 | 15 / 51 | |
| 2.252.0 | 15 / 51 | |
| 2.251.0 | 15 / 51 | |
| 2.248.0 | 15 / 51 | |
| 2.247.0 | 15 / 51 | |
| 2.246.0 | 15 / 51 | |
| 2.240.0 | 15 / 51 | |
| 2.239.0 | 15 / 50 | |
| 2.238.0 | 15 / 50 | |
| 2.237.1 | 14 / 50 | |
| 2.235.0 | 14 / 50 | |
| 2.234.1 | 14 / 50 | |
| 2.232.2 | 14 / 50 | |
| 2.232.1 | 14 / 50 | |
| 2.229.1 | 14 / 50 | |
| 2.229.0 | 14 / 50 | |
| 2.228.0 | 14 / 50 | |
| 2.221.1 | 14 / 50 | |
| 2.221.0 | 14 / 50 | |
| 2.220.0 | 14 / 50 | |
| 2.218.0 | 14 / 50 | |
| 2.214.1 | 14 / 50 | |
| 2.214.0 | 14 / 50 | |
| 2.210.0 | 14 / 50 | |
| 2.209.1 | 14 / 50 | |
| 2.209.0 | 14 / 50 | |
| 2.208.0 | 14 / 50 | |
| 2.207.0 | 14 / 50 | |
| 2.203.1 | 14 / 50 | |
| 2.203.0 | 14 / 50 | |
| 2.202.0 | 14 / 50 | |
| 2.201.0 | 14 / 50 | |
| 2.200.2 | 14 / 50 |
v2.262.1
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.262.0
9 findings
HIGH
Bundled binary files (1)
npm-metadata
Package contains compiled binaries that could be backdoors: • node_modules/@aws/cloudformation-validate/bindings_wasm_bg.wasm
HIGH
New obfuscated file: aws-controlcatalog/lib/controlcatalog.generated.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: aws-outposts/lib/outposts.generated.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: core/lib/private/synthesis-validation.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: aws-dataexchange/lib/dataexchange.generated.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: core/lib/private/deps.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: testhelpers/jest-global-app-testhook.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: core/lib/validation/cloudformation-validate-plugin.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.261.0
3 findings
HIGH
New obfuscated file: aws-bcm/lib/bcm.generated.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: aws-resiliencehubv2/lib/resiliencehubv2.generated.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.254.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.253.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.252.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.246.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.